update neovim plugins

.github/workflows/build-and-cache.yml

@@ -0,0 +1,39 @@
+name: build and cache random stuff
+
+on:
+  workflow_dispatch:
+  push:
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        package:
+          - .#attic-client
+          - .#attic-server
+          - .#eza
+          - .#conduwuit
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          logger: pretty
+
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - uses: cachix/cachix-action@v15
+        with:
+          name: cything
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+      
+      - name: Setup Attic cache
+        uses: ryanccn/attic-action@v0
+        with:
+          endpoint: ${{ vars.ATTIC_ENDPOINT }}
+          cache: ${{ vars.ATTIC_CACHE }}
+          token: ${{ secrets.ATTIC_TOKEN }}
+
+      - uses: actions/checkout@v4
+
+      - run: nix build '${{ matrix.package }}'

.github/workflows/build-machines-and-homes.yml

@@ -1,143 +0,0 @@
-name: build and cache machines and homes
-on:
-  workflow_dispatch:
-  push:
-  pull_request:
-
-env:
-  TERM: ansi
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
-
-jobs:
-  build-machines:
-    strategy:
-      fail-fast: false
-      matrix:
-        machine:
-          - chunk
-          - ytnix
-        os:
-          - ubuntu-latest
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - name: Maximize build disk space
-        uses: easimon/maximize-build-space@v10
-        with:
-          overprovision-lvm: true
-          swap-size-mb: 1024
-          remove-dotnet: 'true'
-          remove-android: 'true'
-          remove-haskell: 'true'
-          remove-codeql: 'true'
-          remove-docker-images: 'true'
-          build-mount-path: /nix
-
-      - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
-      - name: Sync repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: post-build-hook
-        run: |
-          sudo mkdir -p /etc/nix
-          sudo cp ci/upload-to-cache.sh /etc/nix/
-          sudo chmod +x /etc/nix/upload-to-cache.sh
-
-      - name: setup s3 credentials
-        run: |
-          sudo mkdir /root/.aws
-          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
-          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
-          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
-          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v30
-        with:
-          enable_kvm: true
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-            post-build-hook = /etc/nix/upload-to-cache.sh
-
-      - name: build
-        run: |
-          nix run nixpkgs#nixos-rebuild build -- -L --flake ".#${{ matrix.machine }}"
-
-  build-homes:
-    strategy:
-      fail-fast: false
-      matrix:
-        home:
-          - yt@ytnix
-          - yt@chunk
-        os:
-          - ubuntu-latest
-          # - macos-latest
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - name: Maximize build disk space
-        uses: easimon/maximize-build-space@v10
-        with:
-          overprovision-lvm: true
-          swap-size-mb: 1024
-          remove-dotnet: 'true'
-          remove-android: 'true'
-          remove-haskell: 'true'
-          remove-codeql: 'true'
-          remove-docker-images: 'true'
-          build-mount-path: /nix
-
-      - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
-      - name: Sync repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: post-build-hook
-        run: |
-          sudo mkdir -p /etc/nix
-          sudo cp ci/upload-to-cache.sh /etc/nix/
-          sudo chmod +x /etc/nix/upload-to-cache.sh
-
-      - name: setup s3 credentials
-        run: |
-          sudo mkdir /root/.aws
-          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
-          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
-          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
-          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v30
-        with:
-          enable_kvm: true
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-            post-build-hook = /etc/nix/upload-to-cache.sh
-
-      - name: build
-        run: |
-          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
-          nix build -L "$package"

.github/workflows/build-packages.yml

@@ -1,69 +0,0 @@
-name: build and cache packages
-on:
-  workflow_dispatch:
-    inputs:
-      package:
-        description: "package to build"
-        required: false
-        type: string
-
-env:
-  TERM: ansi
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
-
-jobs:
-  build-packages:
-    strategy:
-      fail-fast: false
-      matrix:
-        package:
-          - ${{ inputs.package }}
-        os:
-          - ubuntu-latest
-          - ubuntu-24.04-arm
-          - macos-latest
-          - macos-13
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v30
-        with:
-          enable_kvm: true
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-
-      - run: nix build -L ${{ matrix.package }}
-
-      - name: cache result
-        # https://stackoverflow.com/a/58859404
-        if: '!cancelled()'
-        run: |
-          nix run github:cything/nixcp -- \
-            push \
-            --bucket nixcache \
-            --signing-key ${{ runner.temp }}/cache-priv-key.pem \
-            -u https://nix-community.cachix.org \
-            "${{ matrix.package }}"
-
-      - name: prepare tarball to upload
-        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
-
-      - name: upload result
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.os }}
-          path: result.tar
-          if-no-files-found: error

.github/workflows/lazy-update.yml

@@ -0,0 +1,26 @@
+name: "update lazy plugins"
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * *"
+permissions:
+  pull-requests: write
+  contents: write
+jobs:
+  update-lazy-plugins:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - uses: cachix/install-nix-action@v30
+      - name: Update vim plugins
+        run: |
+          export XDG_CONFIG_HOME=$PWD/home
+          nix run nixpkgs#neovim -- --headless "+Lazy! update" +qa
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          title: update lazy plugins
+          commit-message: update neovim plugins

.github/workflows/mirror.yml

@@ -0,0 +1,19 @@
+name: mirror to gitlab
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: mirror
+        uses: SvanBoxel/gitlab-mirror-and-ci-action@5c211f993d35256d96b772d995972f434b94e11a
+        with:
+          args: "https://git.cything.io/cy/infra"
+        env:
+          FOLLOW_TAGS: "true"
+          FORCE_PUSH: "true"
+          GITLAB_HOSTNAME: "git.cything.io"
+          GITLAB_USERNAME: "cy"
+          GITLAB_PASSWORD: ${{ secrets.GITLAB_PASSWORD }}
+          GITLAB_PROJECT_ID: "2"
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update-flake-lock.yml

@@ -11,32 +11,10 @@ jobs:
   createPullRequest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
+      - uses: actions/checkout@v4
-        with:
-          ssh-key: ${{ secrets.SSH_DEPLOY_KEY }}
-
       - name: Install Nix
-        uses: cachix/install-nix-action@53fb48f556dd912c4814b24ee8059a9c91c82b18
+        uses: cachix/install-nix-action@v30
         with:
-          enable_kvm: true
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = /home/runner/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-
       - name: Update flake.lock
-        run: |
+        uses: DeterminateSystems/update-flake-lock@v24
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-          nix flake update --commit-lock-file
-
-      - name: Create PR
-        uses: peter-evans/create-pull-request@98106d3f2b65918a6591f9e155117b7219ff7e51
-        with:
-          title: nix flake update
-          branch: update-flake-inputs
-          branch-suffix: timestamp

.sops.yaml

@@ -98,47 +98,3 @@ creation_rules:
       - age:
           - *chunk
           - *cy
-  - path_regex: secrets/services/garage.yaml
-    key_groups:
-      - age:
-          - *chunk
-          - *cy
-  - path_regex: secrets/services/tailscale.yaml
-    key_groups:
-      - age:
-          - *chunk
-          - *cy
-  - path_regex: secrets/yt/(.*).yaml$
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-  - path_regex: secrets/services/zipline.yaml
-    key_groups:
-      - age:
-          - *chunk
-          - *cy
-  - path_regex: secrets/services/searx.yaml
-    key_groups:
-      - age:
-          - *chunk
-          - *cy
-  - path_regex: secrets/cache-priv-key.pem
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-          - *chunk
-  - path_regex: secrets/services/authelia.yaml
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-          - *chunk
-  - path_regex: secrets/services/karakeep.yaml
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-          - *chunk
-

README

@@ -1 +0,0 @@
-this is only open source for free ci

README.md

@@ -0,0 +1,40 @@
+# infra
+## ./home
+- [home-manager](https://github.com/nix-community/home-manager) configuration files
+- foot, tmux, and zsh are configured in Nix
+- nvim, rofi, sway, waybar are configured in their own literature and symlinked to $XDG_CONFIG_HOME with home-manager
+
+## ./hosts
+- [`hosts/common.nix`](hosts/common.nix): configuration that makes sense on all computers
+- [`hosts/zsh.nix`](hosts/zsh.nix): for computers that have the power to run zsh
+### ./hosts/ytnix
+- personal laptop
+- a single [`default.nix`](hosts/ytnix/default.nix) that could be modularized but works for now
+
+### ./hosts/chunk
+- the overworked server with 5% SLA
+- very short and concise [`default.nix`](hosts/chunk/default.nix)
+- services organized in their modules
+- some services run through `virtualisation.oci-containers`:
+    - [immich](hosts/chunk/immich.nix)
+    - [conduwuit](hosts/chunk/conduwuit.nix)
+
+### ./hosts/titan
+- got this cause chunk would go down way too often :(
+- hosted on azure for "reliability"
+- runs:
+    - [ghost](hosts/titan/ghost.nix) (through `virtualisation.oci-containers`)
+    - [uptime-kuma](hosts/titan/uptime-kuma.nix)
+    - [ntfy-sh](hosts/titan/ntfy.nix)
+
+## ./secrets
+- secrets
+- see [`.sops.yaml`](.sops.yaml) for who privy to what
+
+## backups
+- hourly borgbackup to [rsync.net](https://rsync.net)
+- see [modules/backup](modules/backup.nix)
+
+## monitoring
+- [status.cything.io](https://status.cything.io/): uptime kuma (reliable)
+- [grafana.cything.io](https://grafana.cything.io/): some real-time metrics here; unlike the status page this will go kaput often

ci/upload-to-cache.sh

@@ -1,8 +0,0 @@
-#!/bin/sh
-
-# https://nix.dev/guides/recipes/post-build-hook.html#implementing-the-build-hook
-set -eu
-set -f # disable globbing
-export IFS=' '
-echo "Uploading paths" $OUT_PATHS
-exec /nix/var/nix/profiles/default/bin/nix copy --to "s3://nixcache?endpoint=s3.cy7.sh&compression=zstd&parallel-compression=true" $OUT_PATHS

flake.lock

@@ -1,12 +1,18 @@
 {
   "nodes": {
     "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1737689766,
+        "lastModified": 1717535930,
-        "narHash": "sha256-ivVXYaYlShxYoKfSo5+y5930qMKKJ8CLcAoIBPQfJ6s=",
+        "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "6fe74265bbb6d016d663b1091f015e2976c4a527",
+        "rev": "55e7754ec31dac78980c8be45f8a28e80e370946",
         "type": "github"
       },
       "original": {
@@ -15,44 +21,51 @@
         "type": "github"
       }
     },
-    "crane_2": {
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1741148495,
+        "lastModified": 1734088167,
-        "narHash": "sha256-EV8KUaIZ2/CdBXlutXrHoZYbWPeB65p5kKZk71gvDRI=",
+        "narHash": "sha256-snPBgTqwn3FPZVdFC5yt7Bnk3squim1vZOZ8CObWykk=",
-        "owner": "ipetkov",
+        "owner": "nix-community",
-        "repo": "crane",
+        "repo": "disko",
-        "rev": "75390a36cd0c2cdd5f1aafd8a9f827d7107f2e53",
+        "rev": "65a441502c9382d41ada1adbc9bd31d6c9b00fe2",
         "type": "github"
       },
       "original": {
-        "owner": "ipetkov",
+        "owner": "nix-community",
-        "repo": "crane",
+        "ref": "latest",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
+    "eza": {
+      "locked": {
+        "lastModified": 1736397430,
+        "narHash": "sha256-l00P7P3zcx8rzYOOQMNUwBqK/yz/4Cv8G8+pYbfyQ5Y=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d722e8ce81cf103280ce1ff65accb3fc25cbd2ba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d722e8ce81cf103280ce1ff65accb3fc25cbd2ba",
         "type": "github"
       }
     },
     "flake-compat": {
-      "locked": {
-        "lastModified": 1717312683,
-        "narHash": "sha256-FrlieJH50AuvagamEvWMIE6D2OAnERuDboFDYAED/dE=",
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "rev": "38fd3954cf65ce6faf3d0d45cd26059e059f07ea",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
+        "lastModified": 1696426674,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -69,11 +82,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740872218,
+        "lastModified": 1717285511,
-        "narHash": "sha256-ZaMw0pdoUKigLpv9HiNDH2Pjnosg7NBYMJlHTIsHEUo=",
+        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3876f6b87db82f33775b1ef5ea343986105db764",
+        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
         "type": "github"
       },
       "original": {
@@ -87,11 +100,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1731533236,
+        "lastModified": 1710146030,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -100,66 +113,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_3": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "garage": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1745093116,
-        "narHash": "sha256-38L/NZyfGSGff9f+FfRd4teA1Xj93hqcBJcqhxbLA7Y=",
-        "owner": "deuxfleurs-org",
-        "repo": "garage",
-        "rev": "4ef954d17604eba8aafa52902cd3c573978c7195",
-        "type": "github"
-      },
-      "original": {
-        "owner": "deuxfleurs-org",
-        "repo": "garage",
-        "type": "github"
-      }
-    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -189,11 +142,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745128386,
+        "lastModified": 1736366465,
-        "narHash": "sha256-xnNxL9lZC5Ez8AxTgHZZu8pYSNM34+5GD5jGSs8Vq4M=",
+        "narHash": "sha256-Fo68EF6p/N9GJyHiAUbXtiE7IJlb3IMjK86LuxFMsRU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f98314bb064cf8f8446c44afbadaaad2505875a7",
+        "rev": "7e00856596891850ba5ad4c5ecd2ed74468c08c5",
         "type": "github"
       },
       "original": {
@@ -204,99 +157,38 @@
     },
     "lanzaboote": {
       "inputs": {
-        "crane": "crane_2",
+        "crane": "crane",
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ],
         "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1741442524,
+        "lastModified": 1718178907,
-        "narHash": "sha256-tVcxLDLLho8dWcO81Xj/3/ANLdVs0bGyCPyKjp70JWk=",
+        "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "d8099586d9a84308ffedac07880e7f07a0180ff4",
+        "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "master",
+        "ref": "v0.4.1",
         "repo": "lanzaboote",
         "type": "github"
       }
     },
-    "nil": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay_3"
-      },
-      "locked": {
-        "lastModified": 1741118843,
-        "narHash": "sha256-ggXU3RHv6NgWw+vc+HO4/9n0GPufhTIUjVuLci8Za8c=",
-        "owner": "oxalica",
-        "repo": "nil",
-        "rev": "577d160da311cc7f5042038456a0713e9863d09e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "nil",
-        "type": "github"
-      }
-    },
-    "nix-index-database": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745120797,
-        "narHash": "sha256-owQ0VQ+7cSanTVPxaZMWEzI22Q4bGnuvhVjLAJBNQ3E=",
-        "owner": "nix-community",
-        "repo": "nix-index-database",
-        "rev": "69716041f881a2af935021c1182ed5b0cc04d40e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-index-database",
-        "type": "github"
-      }
-    },
-    "nix-ld": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744621833,
-        "narHash": "sha256-II6a32kRc+KbLhU/jS8EbuXYt1PNCvsRvuBw2becgQM=",
-        "owner": "nix-community",
-        "repo": "nix-ld",
-        "rev": "9a3812797e25def1d4aed62b517606b7b93989dc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-ld",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744932701,
+        "lastModified": 1736012469,
-        "narHash": "sha256-fusHbZCyv126cyArUwwKrLdCkgVAIaa/fQJYFlCEqiU=",
+        "narHash": "sha256-/qlNWm/IEVVH7GfgAIyP6EsVZI6zjAx1cV5zNyrs+rI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef",
+        "rev": "8f3e1f807051e32d8c95cd12b9b421623850a34d",
         "type": "github"
       },
       "original": {
@@ -306,6 +198,54 @@
         "type": "github"
       }
     },
+    "nixpkgs-borg": {
+      "locked": {
+        "lastModified": 1735547260,
+        "narHash": "sha256-ScKuaBbUXNqS9c6Y+N647BAQx7SvKywpu5MxBV3Y5pk=",
+        "owner": "cything",
+        "repo": "nixpkgs",
+        "rev": "53add6c0c30200663cd21beb06672ec2c8afc176",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cything",
+        "ref": "borg",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-btrbk": {
+      "locked": {
+        "lastModified": 1735945390,
+        "narHash": "sha256-isFSp8EsqnFJE7o07XdT/eia0Rtzvz6NqLt4tCdFido=",
+        "owner": "cything",
+        "repo": "nixpkgs",
+        "rev": "acf701b49a7687e23b4b18701d4ab62285dec029",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cything",
+        "ref": "btrbk",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1710695816,
+        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -316,14 +256,15 @@
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
-        ]
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1740915799,
+        "lastModified": 1717664902,
-        "narHash": "sha256-JvQvtaphZNmeeV+IpHgNdiNePsIpHD5U/7QN5AeY44A=",
+        "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "42b1ba089d2034d910566bf6b40830af6b8ec732",
+        "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1",
         "type": "github"
       },
       "original": {
@@ -334,94 +275,34 @@
     },
     "root": {
       "inputs": {
-        "garage": "garage",
+        "disko": "disko",
+        "eza": "eza",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
-        "nil": "nil",
-        "nix-index-database": "nix-index-database",
-        "nix-ld": "nix-ld",
         "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay_4",
+        "nixpkgs-borg": "nixpkgs-borg",
+        "nixpkgs-btrbk": "nixpkgs-btrbk",
         "sops-nix": "sops-nix",
-        "vscode-extensions": "vscode-extensions"
+        "treefmt": "treefmt"
       }
     },
     "rust-overlay": {
       "inputs": {
-        "nixpkgs": [
+        "flake-utils": [
-          "garage",
+          "lanzaboote",
-          "nixpkgs"
+          "flake-utils"
-        ]
+        ],
-      },
-      "locked": {
-        "lastModified": 1738549608,
-        "narHash": "sha256-GdyT9QEUSx5k/n8kILuNy83vxxdyUfJ8jL5mMpQZWfw=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "35c6f8c4352f995ecd53896200769f80a3e8f22d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "35c6f8c4352f995ecd53896200769f80a3e8f22d",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1741228283,
+        "lastModified": 1717813066,
-        "narHash": "sha256-VzqI+k/eoijLQ5am6rDFDAtFAbw8nltXfLBC6SIEJAE=",
+        "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "38e9826bc4296c9daf18bc1e6aa299f3e932a403",
+        "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_3": {
-      "inputs": {
-        "nixpkgs": [
-          "nil",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1741055476,
-        "narHash": "sha256-52vwEV0oS2lCnx3c/alOFGglujZTLmObit7K8VblnS8=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "aefb7017d710f150970299685e8d8b549d653649",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_4": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745116541,
-        "narHash": "sha256-5xzA6dTfqCfTTDCo3ipPZzrg3wp01xmcr73y4cTNMP8=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "e2142ef330a61c02f274ac9a9cb6f8487a5d0080",
         "type": "github"
       },
       "original": {
@@ -437,11 +318,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744669848,
+        "lastModified": 1736203741,
-        "narHash": "sha256-pXyanHLUzLNd3MX9vsWG+6Z2hTU8niyphWstYEP3/GU=",
+        "narHash": "sha256-eSjkBwBdQk+TZWFlLbclF2rAh4JxbGg8az4w/Lfe7f4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "61154300d945f0b147b30d24ddcafa159148026a",
+        "rev": "c9c88f08e3ee495e888b8d7c8624a0b2519cb773",
         "type": "github"
       },
       "original": {
@@ -465,54 +346,23 @@
         "type": "github"
       }
     },
-    "systems_2": {
+    "treefmt": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "vscode-extensions": {
       "inputs": {
-        "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1745114521,
+        "lastModified": 1736154270,
-        "narHash": "sha256-P/TgmeavrpUiHCejjjsU2vOMB7cBIcHltGDSKKgi20E=",
+        "narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
-        "owner": "nix-community",
+        "owner": "numtide",
-        "repo": "nix-vscode-extensions",
+        "repo": "treefmt-nix",
-        "rev": "ff14820202442f847fd37862eb48a7cb254a19d3",
+        "rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "numtide",
-        "repo": "nix-vscode-extensions",
+        "repo": "treefmt-nix",
         "type": "github"
       }
     }

flake.nix

@@ -3,35 +3,44 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix = {
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:Mic92/sops-nix";
-    home-manager.url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+    };
-    lanzaboote.url = "github:nix-community/lanzaboote/master";
+    home-manager = {
-    lanzaboote.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
-    rust-overlay.url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
-    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+    };
-    nix-ld.url = "github:nix-community/nix-ld";
+    treefmt = {
-    nix-ld.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:numtide/treefmt-nix";
-    nil.url = "github:oxalica/nil";
+      inputs.nixpkgs.follows = "nixpkgs";
-    nil.inputs.nixpkgs.follows = "nixpkgs";
+    };
-    vscode-extensions.url = "github:nix-community/nix-vscode-extensions/";
+    disko = {
-    vscode-extensions.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/disko/latest";
-    nix-index-database.url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
-    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
+    };
-    garage.url = "github:deuxfleurs-org/garage";
+    lanzaboote = {
-    garage.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/lanzaboote/v0.4.1";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nixpkgs-borg.url = "github:cything/nixpkgs/borg"; # unmerged PR
+    nixpkgs-btrbk.url = "github:cything/nixpkgs/btrbk"; # unmerged PR
+    eza.url = "github:nixos/nixpkgs/d722e8ce81cf103280ce1ff65accb3fc25cbd2ba";
   };
 
   nixConfig = {
     extra-substituters = [
-      "https://nix-community.cachix.org"
+      "https://cache.cything.io/central"
-      "https://nixcache.cy7.sh"
+      "https://cache.cything.io/infra-ci"
+      "https://cache.cything.io/attic"
     ];
     extra-trusted-public-keys = [
-      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg="
-      "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
+      "infra-ci:xG5f5tddUBcvToYjlpHD5OY/puYQkKmgKeIQCshNs38="
+      "attic:HL3hVpqXxwcF7Q1R+IvU2i0+YxIjQA2xxKM5EJMXLLs="
     ];
+    builders-use-substitutes = true;
   };
 
   outputs =
@@ -39,66 +48,129 @@
       self,
       nixpkgs,
       home-manager,
+      treefmt,
+      disko,
       ...
     }@inputs:
     let
-        pkgs = import nixpkgs {
+      lib = nixpkgs.lib;
-          config.allowUnfree = true;
+      inherit (self) outputs;
-          system = "x86_64-linux";
+
+      systems = [ "x86_64-linux" ];
+      forEachSystem = f: lib.genAttrs systems (system: f pkgsFor.${system});
+
+      overridePkgsFromFlake =
+        pkgs: flake: pkgNames:
+        let
+          pkgs' = import flake { inherit (pkgs) system config; };
+          pkgNames' = builtins.map (lib.splitString ".") pkgNames;
+          pkgVals = builtins.map (
+            path:
+            let
+              package = lib.getAttrFromPath path pkgs';
+            in
+            lib.setAttrByPath path package
+          ) pkgNames';
+        in
+        lib.foldl' lib.recursiveUpdate { } pkgVals;
+      overlayPkgsFromFlake =
+        flake: pkgNames: _final: prev:
+        overridePkgsFromFlake prev flake pkgNames;
       overlays = [
-            inputs.rust-overlay.overlays.default
+        (overlayPkgsFromFlake inputs.eza [
-            inputs.vscode-extensions.overlays.default
+          "eza"
-          ] ++ (import ./overlay { inherit inputs; });
+        ])
+      ] ++ import ./overlay;
+
+      pkgsFor = lib.genAttrs systems (
+        system:
+        import nixpkgs {
+          inherit system overlays;
+          config = {
+            allowUnfree = true;
           };
+        }
+      );
+
+      treefmtEval = forEachSystem (
+        pkgs:
+        treefmt.lib.evalModule pkgs {
+          projectRootFile = "flake.nix";
+          programs.nixfmt.enable = true;
+          programs.stylua.enable = true;
+          programs.yamlfmt.enable = true;
+          programs.typos.enable = true;
+          programs.shellcheck.enable = true;
+          programs.deadnix.enable = true;
+
+          settings.global.excludes = [ "secrets/*" ];
+        }
+      );
     in
     {
+      formatter = forEachSystem (pkgs: treefmtEval.${pkgs.system}.config.build.wrapper);
+      checks = forEachSystem (pkgs: {
+        formatting = treefmtEval.${pkgs.system}.config.build.check self;
+      });
+      # lets us build overlayed packages with `nix build .#<package>`
+      packages = pkgsFor;
+
       nixosConfigurations =
         let
-            lib = nixpkgs.lib;
+          pkgs = pkgsFor.x86_64-linux;
         in
         {
           ytnix = lib.nixosSystem {
-              specialArgs = { inherit inputs; };
+            specialArgs = { inherit inputs outputs; };
             modules = [
               {
                 nixpkgs = { inherit pkgs; };
               }
               ./hosts/ytnix
-                ./modules
               inputs.sops-nix.nixosModules.sops
+              ./modules
               inputs.lanzaboote.nixosModules.lanzaboote
-                inputs.nix-ld.nixosModules.nix-ld
             ];
           };
+
           chunk = lib.nixosSystem {
-              specialArgs = { inherit inputs; };
+            specialArgs = { inherit inputs outputs; };
             modules = [
               {
                 nixpkgs = { inherit pkgs; };
               }
               ./hosts/chunk
-                ./modules
               inputs.sops-nix.nixosModules.sops
-              ];
+              ./modules
-            };
-          };
-        homeConfigurations =
-          let
-            lib = home-manager.lib;
-          in
-          {
-            "yt@ytnix" = lib.homeManagerConfiguration {
-              inherit pkgs;
-              extraSpecialArgs = { inherit inputs; };
-              modules = [
-                ./home/yt/ytnix.nix
-                inputs.nix-index-database.hmModules.nix-index
             ];
           };
 
-            "yt@chunk" = lib.homeManagerConfiguration {
+          titan = lib.nixosSystem {
-              inherit pkgs;
+            specialArgs = { inherit inputs outputs; };
-              extraSpecialArgs = { inherit inputs; };
+            modules = [
+              {
+                nixpkgs = { inherit pkgs; };
+              }
+              ./hosts/titan
+              disko.nixosModules.disko
+              inputs.sops-nix.nixosModules.sops
+              ./modules
+            ];
+          };
+        };
+
+      homeConfigurations = {
+        "yt@ytnix" = home-manager.lib.homeManagerConfiguration {
+          pkgs = pkgsFor.x86_64-linux;
+          extraSpecialArgs = { inherit inputs outputs; };
+          modules = [
+            ./home/yt/ytnix.nix
+          ];
+        };
+
+        "yt@chunk" = home-manager.lib.homeManagerConfiguration {
+          pkgs = pkgsFor.x86_64-linux;
+          extraSpecialArgs = { inherit inputs outputs; };
           modules = [
             ./home/yt/chunk.nix
           ];

home/codium.nix

@@ -1,254 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  programs.vscode = {
-    enable = true;
-    package = pkgs.vscodium;
-    mutableExtensionsDir = false;
-    profiles.default = {
-      enableUpdateCheck = false;
-      enableExtensionUpdateCheck = false;
-      extensions =
-        # if unfree
-        # with pkgs.vscode-marketplace;
-        with pkgs.open-vsx; [
-          vscodevim.vim
-          jnoortheen.nix-ide
-          github.github-vscode-theme
-          rust-lang.rust-analyzer
-          shd101wyy.markdown-preview-enhanced
-          alefragnani.bookmarks
-          tomrijndorp.find-it-faster
-          streetsidesoftware.code-spell-checker
-          emilast.logfilehighlighter
-          tamasfe.even-better-toml
-          golang.go
-          ms-python.python
-        ];
-      userSettings =
-        let
-          vimCommonKeyBindings = [
-            # nice emacs bindings
-            {
-              "before" = [ "C-a" ];
-              "commands" = [ "cursorHome" ];
-            }
-            {
-              "before" = [ "C-e" ];
-              "commands" = [ "cursorEnd" ];
-            }
-            {
-              "before" = [ "C-b" ];
-              "commands" = [ "cursorLeft" ];
-            }
-            {
-              "before" = [ "C-f" ];
-              "commands" = [ "cursorRight" ];
-            }
-            # ctrl+h to turn off search highlighting
-            {
-              "before" = [ "C-h" ];
-              "commands" = [ ":nohl" ];
-            }
-          ];
-        in
-        {
-          "workbench.colorTheme" = "GitHub Dark Default";
-          "workbench.startupEditor" = "none";
-          "workbench.enableExperiments" = false;
-          "files.autoSave" = "onFocusChange";
-          "editor.fontFamily" = "IBM Plex Mono";
-          "editor.fontSize" = 15;
-          "editor.minimap.enabled" = false;
-          "window.zoomLevel" = 0.5;
-          "security.promptForLocalFileProtocolHandling" = false;
-          "security.promptForRemoteFileProtocolHandling" = false;
-          "explorer.confirmDelete" = false;
-          "explorer.confirmDragAndDrop" = false;
-          "editor.acceptSuggestionOnEnter" = "off";
-          "editor.acceptSuggestionOnCommitCharacter" = false;
-          "git.openRepositoryInParentFolders" = "never";
-          "git.ignoreLimitWarning" = true;
-          "git.blame.editorDecoration.enabled" = true;
-          "extensions.ignoreRecommendations" = true;
-          "telemetry.enableTelemetry" = false;
-          "telemetry.telemetryLevel" = "off";
-          "window.titleBarStyle" = "custom";
-          "editor.formatOnSave" = true;
-
-          # terminal stuff
-          "terminal.integrated.cursorBlinking" = true;
-          "terminal.integrated.cursorStyle" = "line";
-          "terminal.integrated.customGlyphs" = false;
-          "terminal.integrated.env.linux" = {
-            # https://github.com/tomrijndorp/vscode-finditfaster/issues/112#issuecomment-2475227546
-            FZF_DEFAULT_OPTS = "--bind ctrl-n:down,ctrl-p:up";
-          };
-          # don't let the workbench handle terminal keys like ctrl+n and friends
-          "terminal.integrated.sendKeybindingsToShell" = true;
-          "terminal.integrated.allowChords" = false;
-
-          "markdown-preview-enhanced.previewTheme" = "github-dark.css";
-          "nix.enableLanguageServer" = true;
-          "nix.serverPath" = "${lib.getExe pkgs.nil}";
-          "bookmarks.saveBookmarksInProject" = true;
-
-          "cSpell.enabledFileTypes" = {
-            "markdown" = true;
-            "*" = false;
-          };
-
-          # vim stuff
-          "vim.leader" = ",";
-          "extensions.experimental.affinity" = {
-            "vscodevim.vim" = 1;
-          };
-          "vim.sneak" = true;
-          "vim.sneakUseIgnorecaseAndSmartcase" = true;
-          "vim.enableNeovim" = true;
-          "vim.hlsearch" = true;
-          "vim.easymotion" = true;
-          "editor.lineNumbers" = "relative";
-          "vim.normalModeKeyBindings" = vimCommonKeyBindings ++ [
-            {
-              "before" = [ ";" ];
-              "after" = [ ":" ];
-              "silent" = true;
-            }
-            {
-              "before" = [
-                "<leader>"
-                "m"
-              ];
-              "commands" = [ "bookmarks.toggle" ];
-            }
-            {
-              "before" = [
-                "<leader>"
-                "l"
-              ];
-              "commands" = [ "bookmarks.toggleLabeled" ];
-            }
-            {
-              "before" = [
-                "<leader>"
-                "b"
-              ];
-              "commands" = [ "bookmarks.list" ];
-            }
-            {
-              "before" = [
-                "<leader>"
-                "s"
-              ];
-              "commands" = [ "workbench.action.toggleSidebarVisibility" ];
-            }
-            {
-              "before" = [
-                "<space>"
-                "s"
-              ];
-              "commands" = [ "workbench.action.toggleSidebarVisibility" ];
-            }
-            {
-              "before" = [
-                "<leader>"
-                "f"
-                "f"
-              ];
-              "commands" = [ "find-it-faster.findFiles" ];
-            }
-            {
-              "before" = [
-                "<leader>"
-                "f"
-                "g"
-              ];
-              "commands" = [ "find-it-faster.findWithinFiles" ];
-            }
-            {
-              "before" = [
-                "<leader>"
-                "f"
-                "t"
-              ];
-              "commands" = [ "find-it-faster.findWithinFilesWithType" ];
-            }
-            # "gd" for definitions is by default
-            {
-              "before" = [
-                "g"
-                "r"
-              ];
-              "commands" = [ "editor.action.goToReferences" ];
-            }
-            # the default is weird when you need to go back within a file
-            {
-              "before" = [ "C-o" ];
-              "commands" = [ "workbench.action.navigateBack" ];
-            }
-            {
-              "before" = [ "C-i" ];
-              "commands" = [ "workbench.action.navigateForward" ];
-            }
-            # insert line without leaving normal mode
-            {
-              "before" = [
-                "<space>"
-                "o"
-              ];
-              "commands" = [ "editor.action.insertLineAfter" ];
-            }
-            {
-              "before" = [
-                "<space>"
-                "O"
-              ];
-              "commands" = [ "editor.action.insertLineBefore" ];
-            }
-          ];
-          "vim.insertModeKeyBindings" = vimCommonKeyBindings ++ [
-            {
-              "before" = [ "C-k" ];
-              "commands" = [ "acceptSelectedSuggestion" ];
-            }
-          ];
-          "vim.visualModeKeyBindings" = vimCommonKeyBindings ++ [
-            {
-              "before" = [ ">" ];
-              "commands" = [ "editor.action.indentLines" ];
-            }
-            {
-              "before" = [ "<" ];
-              "commands" = [ "editor.action.outdentLines" ];
-            }
-          ];
-        };
-      keybindings = [
-        # repeat these vim bindings here cause otherwise they get overridden by vscode
-        {
-          "key" = "ctrl+b";
-          "when" = "inputFocus";
-          "command" = "cursorLeft";
-        }
-        {
-          "key" = "ctrl+f";
-          "when" = "inputFocus";
-          "command" = "cursorRight";
-        }
-        # clear default bindings that conflict
-        {
-          "key" = "ctrl+f";
-          "command" = "-actions.find";
-        }
-        {
-          "key" = "ctrl+b";
-          "command" = "-workbench.action.toggleSidebarVisibility";
-        }
-        {
-          "key" = "ctrl+w";
-          "command" = "-workbench.action.closeActiveEditor";
-        }
-      ];
-    };
-  };
-}

home/fish.nix

@@ -0,0 +1,80 @@
+{ ... }:
+{
+  programs.fish = {
+    enable = true;
+    shellAliases = {
+      "vi" = "nvim";
+      "vim" = "nvim";
+      "t" = "tmux";
+      "tl" = "tmux list-sessions";
+      "ta" = "tmux new-session -A -s";
+      "se" = "sudoedit";
+      "s" = "sudo";
+      "nrs" = "sudo nixos-rebuild switch --flake .";
+      "nrt" = "sudo nixos-rebuild test --flake .";
+      "hrs" = "home-manager switch --flake .";
+      "g" = "git";
+      "ga" = "git add";
+      "gaa" = "git add --all";
+      "gb" = "git branch";
+      "gc" = "git commit --verbose";
+      "gcmsg" = "git commit --message";
+      "gd" = "git diff";
+      "gdca" = "git diff --cached";
+      "gds" = "git diff --staged";
+      "gl" = "git log --stat";
+      "glg" = "git log --graph";
+      "glga" = "git log --graph --decorate --all";
+      "glo" = "git log --oneline --decorate";
+      "gp" = "git push";
+      "gr" = "git remote";
+      "gra" = "git remote add";
+      "grv" = "git remote --verbose";
+      "gs" = "git status --short";
+      "gss" = "git status";
+    };
+
+    shellInit = ''
+      set fish_greeting
+    '';
+
+    functions = {
+      fish_prompt = ''
+        set -l last_status $status
+        set -l normal (set_color normal)
+        set -l status_color (set_color brgreen)
+        set -l cwd_color (set_color $fish_color_cwd)
+        set -l vcs_color (set_color brpurple)
+        set -l prompt_status ""
+
+        # Since we display the prompt on a new line allow the directory names to be longer.
+        set -q fish_prompt_pwd_dir_length
+        or set -lx fish_prompt_pwd_dir_length 0
+
+        # Color the prompt differently when we're root
+        set -l suffix '❯'
+        if functions -q fish_is_root_user; and fish_is_root_user
+            if set -q fish_color_cwd_root
+                set cwd_color (set_color $fish_color_cwd_root)
+            end
+            set suffix '#'
+        end
+
+        # Color the prompt in red on error
+        if test $last_status -ne 0
+            set status_color (set_color $fish_color_error)
+            set prompt_status $status_color "[" $last_status "]" $normal
+        end
+
+        echo -s (prompt_login) ' ' $cwd_color (prompt_pwd) $vcs_color (fish_vcs_prompt) $normal ' ' $prompt_status
+        echo -n -s $status_color $suffix ' ' $normal
+      '';
+
+    };
+  };
+
+  programs.fzf.enableFishIntegration = true;
+  programs.zoxide.enableFishIntegration = true;
+  programs.eza.enableFishIntegration = true;
+  programs.nix-index.enableFishIntegration = true;
+}

home/foot.nix

@@ -0,0 +1,63 @@
+{ ... }:
+{
+  programs.foot = {
+    enable = true;
+    settings = {
+      main = {
+        font = "IBM Plex Mono:size=8";
+        dpi-aware = "yes";
+      };
+      bell = {
+        urgent = "no";
+        notify = "no";
+        visual = "no";
+      };
+      cursor = {
+        style = "beam";
+        blink = "yes";
+        blink-rate = 500;
+        beam-thickness = 1.5;
+      };
+      mouse = {
+        hide-when-typing = "yes";
+      };
+      colors = {
+        background = "161821";
+        foreground = "c6c8d1";
+
+        selection-background = "1e2132";
+        selection-foreground = "c6c8d1";
+
+        regular0 = "161821";
+        bright0 = "6b7089";
+
+        regular1 = "e27878";
+        bright1 = "e98989";
+
+        regular2 = "b4be82";
+        bright2 = "c0ca8e";
+
+        regular3 = "e2a478";
+        bright3 = "e9b189";
+
+        regular4 = "84a0c6";
+        bright4 = "91acd1";
+
+        regular5 = "a093c7";
+        bright5 = "ada0d3";
+
+        regular6 = "89b8c2";
+        bright6 = "95c4ce";
+
+        regular7 = "c6c8d1";
+        bright7 = "d2d4de";
+      };
+
+      key-bindings = {
+        clipboard-copy = "Control+Shift+c XF86Copy";
+        clipboard-paste = "Control+Shift+v XF86Paste";
+        quit = "Control+q";
+      };
+    };
+  };
+}

home/irssi.nix

@@ -1,22 +0,0 @@
-{ ... }:
-{
-  programs.irssi = {
-    enable = true;
-    networks.liberachat = {
-      nick = "cy7";
-      server = {
-        address = "irc.libera.chat";
-        port = 6697;
-        autoConnect = true;
-      };
-      channels = {
-        nixos.autoJoin = true;
-        linux.autoJoin = true;
-        rust.autoJoin = true;
-      };
-    };
-    extraConfig = ''
-      ignores = ( { level = "JOINS PARTS QUITS MODES NICKS"; } )
-    '';
-  };
-}

home/kitty.nix

@@ -1,86 +0,0 @@
-{ pkgs, ... }:
-{
-  programs.kitty = {
-    enable = true;
-    font = {
-      name = "IBM Plex Mono";
-      package = pkgs.ibm-plex;
-      size = 12;
-    };
-    settings = {
-      enable_audio_bell = true;
-      # how many windows should be open before kitty asks
-      # for confirmation
-      confirm_os_window_close = 0;
-      clear_all_shortcuts = true;
-
-      # will probably lower this later but the max allowed is actually 4GB
-      # this is NOT stored in memory and can only be viewed with scrollback_pager
-      "scrollback_pager_history_size" = "10"; # in MB
-      # see https://github.com/sharkdp/bat/issues/1077#issuecomment-652785399
-      "scrollback_pager" = "bat --pager='less -FR +G'";
-      # "scrollback_lines" = 20000;
-      wheel_scroll_multiplier = 50;
-    };
-    keybindings = {
-      # kitty_mod is ctrl+shift by default
-      "kitty_mod+c" = "copy_to_clipboard";
-      "kitty_mod+v" = "paste_from_clipboard";
-      # "ctrl+q" = "quit";
-
-      "kitty_mod+m" = "show_scrollback";
-
-      # windows
-      "kitty_mod+h" = "neighboring_window left";
-      "kitty_mod+alt+h" = "move_window left";
-      "kitty_mod+l" = "neighboring_window right";
-      "kitty_mod+alt+l" = "move_window right";
-      "kitty_mod+j" = "neighboring_window down";
-      "kitty_mod+alt+j" = "move_window down";
-      "kitty_mod+k" = "neighboring_window up";
-      "kitty_mod+alt+k" = "move_window up";
-      "ctrl+f3" = "detach_window new-tab";
-      "ctrl+f4" = "detach_window tab-left";
-      "ctrl+f5" = "load_config_file";
-      "ctrl+alt+l" = "next_layout";
-      "ctrl+alt+t" = "goto_layout tall";
-      "ctrl+alt+s" = "goto_layout stack";
-      "kitty_mod+enter" = "new_window_with_cwd";
-      "kitty_mod+r" = "resize_window";
-      # this closes the *current* window, not the *OS* window
-      # https://sw.kovidgoyal.net/kitty/overview/#tabs-and-windows
-      "kitty_mod+w" = "close_window";
-
-      # tabs
-      "kitty_mod+n" = "next_tab";
-      "kitty_mod+p" = "previous_tab";
-      "kitty_mod+alt+n" = "move_tab_forward";
-      "kitty_mod+alt+p" = "move_tab_backward";
-      "kitty_mod+q" = "close_tab";
-      "kitty_mod+t" = "new_tab_with_cwd";
-
-      # hints
-      # > basically means the preceding key is a prefix (think tmux)
-      "kitty_mod+o>o" = "open_url_with_hints";
-      # `--program @` means copy to clipboard
-      "kitty_mod+o>u" = "kitten hints --type url --program @";
-      "kitty_mod+o>p" = "kitten hints --type path --program @";
-      "kitty_mod+o>n" = "kitten hints --type line --program @";
-      "kitty_mod+o>w" = "kitten hints --type word --program @";
-      "kitty_mod+o>h" = "kitten hints --type hash --program @";
-      "kitty_mod+o>l" = "kitten hints --type linenum";
-
-      # scrolling
-      "kitty_mod+u" = "scroll_page_up";
-      "kitty_mod+d" = "scroll_page_down";
-      "kitty_mod+a" = "scroll_home";
-      "kitty_mod+e" = "scroll_end";
-      "kitty_mod+z" = "scroll_to_prompt -1"; # scroll to previous shell prompt
-      "kitty_mod+x" = "scroll_to_prompt 1"; # scroll to next shell prompt
-      "kitty_mod+y" = "show_scrollback"; # browse scrollback buffer in pager
-      "kitty_mod+g" = "show_last_command_output"; # browse output of last command in pager
-    };
-  };
-
-  programs.zsh.shellAliases."ssh" = "kitten ssh";
-}

home/nvim/init.lua

@@ -0,0 +1,84 @@
+require("plugin_specs")
+
+local keymap = vim.keymap
+local opt = vim.opt
+local api = vim.api
+
+vim.g.loaded_netrw = 1
+vim.g.loaded_netrwPlugin = 1
+vim.opt.termguicolors = true
+require("nvim-tree").setup()
+
+require("lualine").setup({
+	options = {
+		theme = "auto",
+		icons_enabled = true,
+		globalstatus = true,
+	},
+})
+
+require("gitsigns").setup()
+
+opt.tabstop = 2
+opt.softtabstop = 2
+opt.shiftwidth = 2
+opt.expandtab = true
+opt.relativenumber = true
+opt.ignorecase = true
+opt.smartcase = true
+opt.scrolloff = 3
+opt.confirm = true
+opt.history = 500
+opt.undofile = true
+opt.termguicolors = true
+opt.showmode = false
+opt.mouse = ""
+opt.wrap = false
+opt.clipboard:append("unnamedplus")
+
+vim.cmd.colorscheme("iceberg")
+
+-- restore terminal cursor on exit
+api.nvim_create_autocmd("VimLeave", {
+	callback = function()
+		opt.guicursor = "a:ver25-blinkon500-blinkon500"
+	end,
+})
+
+-- blinking cursor in insert mode
+opt.guicursor = "i-ci-ve:ver25-blinkon500-blinkon500"
+
+keymap.set("n", "<space>s", require("nvim-tree.api").tree.toggle, {
+	desc = "toggle nvim-tree",
+	silent = true,
+})
+
+-- shortcut to command mode
+keymap.set({ "n", "x" }, ";", ":", { silent = true })
+
+keymap.set("n", "<space>o", "printf('m`%so<ESC>``', v:count1)", {
+	expr = true,
+	desc = "insert line below without moving cursor",
+})
+
+keymap.set("n", "<space>O", "printf('m`%sO<ESC>``', v:count1)", {
+	expr = true,
+	desc = "insert line above without moving cursor",
+})
+
+keymap.set("n", "/", [[/\v]])
+
+keymap.set("n", "c", '"_c')
+keymap.set("n", "C", '"_C')
+keymap.set("n", "cc", '"_cc')
+keymap.set("x", "c", '"_c')
+keymap.set("x", "p", '"_c<Esc>p')
+
+-- Break inserted text into smaller undo units when we insert some punctuation chars.
+local undo_ch = { ",", ".", "!", "?", ";", ":" }
+for _, ch in ipairs(undo_ch) do
+	keymap.set("i", ch, ch .. "<c-g>u")
+end
+
+keymap.set("i", "<C-A>", "<HOME>")
+keymap.set("i", "<C-E>", "<END>")

home/nvim/lazy-lock.json

@@ -0,0 +1,24 @@
+{
+  "LuaSnip": { "branch": "master", "commit": "03c8e67eb7293c404845b3982db895d59c0d1538" },
+  "cmp-buffer": { "branch": "main", "commit": "3022dbc9166796b644a841a02de8dd1cc1d311fa" },
+  "cmp-cmdline": { "branch": "main", "commit": "d250c63aa13ead745e3a40f61fdd3470efde3923" },
+  "cmp-nvim-lsp": { "branch": "main", "commit": "99290b3ec1322070bcfb9e846450a46f6efa50f0" },
+  "cmp-omni": { "branch": "main", "commit": "4ef610bbd85a5ee4e97e09450c0daecbdc60de86" },
+  "cmp-path": { "branch": "main", "commit": "91ff86cd9c29299a64f968ebb45846c485725f23" },
+  "cmp_luasnip": { "branch": "master", "commit": "98d9cb5c2c38532bd9bdb481067b20fea8f32e90" },
+  "dressing.nvim": { "branch": "master", "commit": "3a45525bb182730fe462325c99395529308f431e" },
+  "fzf-lua": { "branch": "main", "commit": "7e63bc8a61ef9f38b513a19718308e57f4729d14" },
+  "gitsigns.nvim": { "branch": "main", "commit": "68114837e81ca16d06514c3a997c9102d1b25c15" },
+  "hop.nvim": { "branch": "master", "commit": "08ddca799089ab96a6d1763db0b8adc5320bf050" },
+  "iceberg.vim": { "branch": "master", "commit": "23835d5ed696436f716cbfdb56a93a7850fe3b18" },
+  "lazy.nvim": { "branch": "main", "commit": "d8f26efd456190241afd1b0f5235fe6fdba13d4a" },
+  "lualine.nvim": { "branch": "master", "commit": "2a5bae925481f999263d6f5ed8361baef8df4f83" },
+  "nvim-autopairs": { "branch": "master", "commit": "d2f791ceeb26d04d87aa54343bc94e8ad8d7be1c" },
+  "nvim-cmp": { "branch": "main", "commit": "8c82d0bd31299dbff7f8e780f5e06d2283de9678" },
+  "nvim-lspconfig": { "branch": "master", "commit": "88157521e890fe7fdf18bee22438875edd6300a6" },
+  "nvim-tree.lua": { "branch": "master", "commit": "68fc4c20f5803444277022c681785c5edd11916d" },
+  "nvim-treesitter": { "branch": "master", "commit": "6df6e80417b58abe377c90f5e3f7fe94cf7dfc55" },
+  "nvim-web-devicons": { "branch": "master", "commit": "e021fafde718c8b6928ea11c65ca5f919e7b50f4" },
+  "tokyonight.nvim": { "branch": "main", "commit": "7bb270adaa7692c2c33befc35f5567fc596a2504" },
+  "vim-commentary": { "branch": "master", "commit": "64a654ef4a20db1727938338310209b6a63f60c9" }
+}

home/nvim/lua/config/fzf.lua

@@ -0,0 +1,21 @@
+local keymap = vim.keymap
+
+local fzf = require("fzf-lua")
+
+keymap.set("n", "<leader>ff", fzf.files, { silent = true })
+keymap.set("n", "<leader>fr", fzf.oldfiles, { silent = true })
+keymap.set("n", "<leader>fc", fzf.resume, { silent = true })
+keymap.set("n", "<leader>fs", fzf.treesitter, { silent = true })
+keymap.set("n", "<leader>fg", fzf.grep_project, { silent = true })
+
+fzf.setup({
+	"fzf-native",
+	keymap = {
+		fzf = {
+			["ctrl-u"] = "half-page-up",
+			["ctrl-d"] = "half-page-down",
+			["ctrl-j"] = "preview-page-down",
+			["ctrl-k"] = "preview-page-up",
+		},
+	},
+})

home/nvim/lua/config/hop.lua

@@ -0,0 +1,16 @@
+local hop = require("hop")
+local keymap = vim.keymap
+
+hop.setup({
+	case_insensitive = true,
+	char2_fallback_key = "<CR>",
+	quit_key = "<Esc",
+})
+
+keymap.set({ "n", "v", "o" }, "<C-t>", "", {
+	silent = true,
+	noremap = true,
+	callback = function()
+		hop.hint_char1()
+	end,
+})

home/nvim/lua/config/lsp.lua

@@ -0,0 +1,74 @@
+local lsp = vim.lsp
+local diagnostic = vim.diagnostic
+local keymap = vim.keymap
+
+keymap.set("n", "gd", lsp.buf.definition)
+keymap.set("n", "<space>rn", lsp.buf.rename)
+keymap.set("n", "gr", lsp.buf.references)
+keymap.set("n", "[d", diagnostic.goto_prev)
+keymap.set("n", "]d", diagnostic.goto_next)
+
+diagnostic.config({
+	signs = false,
+})
+
+local lspconfig = require("lspconfig")
+local capabilities = require("cmp_nvim_lsp").default_capabilities()
+
+lspconfig.pylsp.setup({ capabilities = capabilities })
+lspconfig.clangd.setup({ capabilities = capabilities })
+lspconfig.bashls.setup({ capabilities = capabilities })
+lspconfig.rust_analyzer.setup({
+	capabilities = capabilities,
+})
+
+lspconfig.gopls.setup({
+	settings = {
+		gopls = {
+			analyses = {
+				unusedparams = true,
+			},
+			staticcheck = true,
+			gofumpt = true,
+		},
+	},
+	capabilities = capabilities,
+})
+
+lspconfig.lua_ls.setup({
+	capabilities = capabilities,
+	on_init = function(client)
+		if client.workspace_folders then
+			local path = client.workspace_folders[1].name
+			if vim.uv.fs_stat(path .. "/.luarc.json") or vim.uv.fs_stat(path .. "/.luarc.jsonc") then
+				return
+			end
+		end
+
+		client.config.settings.Lua = vim.tbl_deep_extend("force", client.config.settings.Lua, {
+			runtime = {
+				-- Tell the language server which version of Lua you're using
+				-- (most likely LuaJIT in the case of Neovim)
+				version = "LuaJIT",
+			},
+			-- Make the server aware of Neovim runtime files
+			workspace = {
+				checkThirdParty = false,
+				library = {
+					vim.env.VIMRUNTIME,
+					-- Depending on the usage, you might want to add additional paths here.
+					-- "${3rd}/luv/library"
+					-- "${3rd}/busted/library",
+				},
+				-- or pull in all of 'runtimepath'. NOTE: this is a lot slower
+				-- library = vim.api.nvim_get_runtime_file("", true)
+			},
+		})
+	end,
+	settings = {
+		Lua = {},
+	},
+})
+
+lspconfig.nixd.setup({ capabilities = capabilities })
+lspconfig.terraformls.setup({ capabilities = capabilities })

home/nvim/lua/config/nvim-cmp.lua

@@ -0,0 +1,54 @@
+local cmp = require("cmp")
+local luasnip = require("luasnip")
+
+cmp.setup({
+	snippet = {
+		expand = function(args)
+			require("luasnip").lsp_expand(args.body)
+		end,
+	},
+	mapping = {
+		["<C-h"] = cmp.mapping.abort(),
+
+		["<C-k>"] = cmp.mapping(function(fallback)
+			if cmp.visible() then
+				if luasnip.expandable() then
+					luasnip.expand()
+				else
+					cmp.confirm({
+						select = true,
+					})
+				end
+			else
+				fallback()
+			end
+		end),
+
+		["<C-n>"] = cmp.mapping(function(fallback)
+			if luasnip.locally_jumpable(1) then
+				luasnip.jump(1)
+			elseif cmp.visible() then
+				cmp.select_next_item()
+			else
+				fallback()
+			end
+		end, { "i", "s" }),
+
+		["<C-p>"] = cmp.mapping(function(fallback)
+			if luasnip.locally_jumpable(-1) then
+				luasnip.jump(-1)
+			elseif cmp.visible() then
+				cmp.select_prev_item()
+			else
+				fallback()
+			end
+		end, { "i", "s" }),
+	},
+	sources = cmp.config.sources({
+		{ name = "nvim_lsp" },
+		{ name = "luasnip" },
+	}, {
+		{ name = "buffer" },
+		{ name = "path" },
+	}),
+})

home/nvim/lua/plugin_specs.lua

@@ -0,0 +1,99 @@
+-- Bootstrap lazy.nvim
+local lazypath = vim.fn.stdpath("data") .. "/lazy/lazy.nvim"
+if not (vim.uv or vim.loop).fs_stat(lazypath) then
+	local lazyrepo = "https://github.com/folke/lazy.nvim.git"
+	local out = vim.fn.system({ "git", "clone", "--filter=blob:none", "--branch=stable", lazyrepo, lazypath })
+	if vim.v.shell_error ~= 0 then
+		vim.api.nvim_echo({
+			{ "Failed to clone lazy.nvim:\n", "ErrorMsg" },
+			{ out, "WarningMsg" },
+			{ "\nPress any key to exit..." },
+		}, true, {})
+		vim.fn.getchar()
+		os.exit(1)
+	end
+end
+vim.opt.rtp:prepend(lazypath)
+
+vim.g.mapleader = ","
+
+local plugin_specs = {
+	{
+		"nvim-treesitter/nvim-treesitter",
+		build = ":TSUpdate",
+		event = "VeryLazy",
+	},
+
+	{
+		"neovim/nvim-lspconfig",
+		event = { "BufRead", "BufNewFile" },
+		config = function()
+			require("config.lsp")
+		end,
+	},
+
+	{
+		"hrsh7th/nvim-cmp",
+		event = "VeryLazy",
+		dependencies = {
+			"hrsh7th/cmp-nvim-lsp",
+			"hrsh7th/cmp-path",
+			"hrsh7th/cmp-buffer",
+			"hrsh7th/cmp-omni",
+			"hrsh7th/cmp-cmdline",
+			"saadparwaiz1/cmp_luasnip",
+		},
+		config = function()
+			require("config.nvim-cmp")
+		end,
+	},
+
+	{
+		"L3MON4D3/LuaSnip",
+		version = "v2.*",
+		build = "make install_jsregexp",
+	},
+
+	{ "stevearc/dressing.nvim", event = "VeryLazy" },
+
+	{
+		"nvim-tree/nvim-tree.lua",
+		lazy = false,
+		dependencies = {
+			"nvim-tree/nvim-web-devicons",
+		},
+	},
+
+	{
+		"ibhagwan/fzf-lua",
+		dependencies = { "nvim-tree/nvim-web-devicons" },
+		config = function()
+			require("config.fzf")
+		end,
+	},
+
+	{ "windwp/nvim-autopairs", event = "InsertEnter", config = true },
+
+	{ "tpope/vim-commentary", event = "VeryLazy" },
+
+	{ "folke/tokyonight.nvim", lazy = false, priority = 1000 },
+
+	{ "lewis6991/gitsigns.nvim" },
+
+	{ "nvim-lualine/lualine.nvim", dependencies = { "nvim-tree/nvim-web-devicons" } },
+
+	{
+		"smoka7/hop.nvim",
+		version = "*",
+		config = function()
+			require("config.hop")
+		end,
+	},
+
+	{ "cocopon/iceberg.vim" },
+}
+
+require("lazy").setup({
+	spec = plugin_specs,
+	rocks = { enabled = true },
+})

home/plasma.nix

@@ -1,85 +0,0 @@
-{ ... }:
-{
-  programs.plasma = {
-    enable = true;
-    overrideConfig = true;
-    immutableByDefault = true;
-    workspace = {
-      lookAndFeel = "org.ide.breezedark.desktop";
-      cursor = {
-        theme = "Bibata-Modern-Classic";
-        size = 23;
-      };
-    };
-
-    fonts = {
-      general = {
-        family = "IBM Plex Mono";
-        pointSize = 12;
-      };
-    };
-
-    input.keyboard = {
-      numlockOnStartup = "on";
-      options = [ "ctrl:nocaps" ];
-    };
-
-    # Meta key is actually the Super key in KDE
-
-    hotkeys.commands = {
-      "launch-terminal" = {
-        name = "launch terminal";
-        key = "Meta+Return";
-        command = "kitty";
-      };
-      "launch-browser" = {
-        name = "launch browser";
-        key = "Meta+B";
-        command = "chromium";
-      };
-      "launch-fuzzel" = {
-        name = "launch-fuzzel";
-        key = "Meta+d";
-        command = "fuzzel";
-      };
-    };
-
-    shortcuts = {
-      kwin = {
-        "Switch Window Down" = "Meta+J";
-        "Switch Window Left" = "Meta+H";
-        "Switch Window Right" = "Meta+L";
-        "Switch Window Up" = "Meta+K";
-        "Window Quick Tile Down" = "Meta+Shift+J";
-        "Window Quick Tile Left" = "Meta+Shift+H";
-        "Window Quick Tile Right" = "Meta+Shift+L";
-        "Window Quick Tile Up" = "Meta+Shift+K";
-        "Window Close" = "Meta+Ctrl+Q";
-        "Window Maximize" = "Meta+W";
-        "Window Minimize" = "Meta+Shift+-";
-        "Window Fullscreen" = "Meta+F";
-        "Window Shrink Horizontal" = "Meta+-";
-      };
-
-      ksmserver = {
-        "Lock Session" = [
-          "Screensaver"
-          "Meta+Ctrl+L"
-        ];
-      };
-    };
-
-    configFile = {
-      # save RAM
-      baloofilerc."Basic Settings"."Indexing-Enabled" = false;
-    };
-
-    # looks like KDE overrides services.logind settings
-    powerdevil.AC = {
-      whenLaptopLidClosed = "hibernate";
-    };
-    powerdevil.battery = {
-      whenLaptopLidClosed = "hibernate";
-    };
-  };
-}

home/rofi/config.rasi

@@ -0,0 +1,156 @@
+configuration {
+    modes: "drun,run,emoji:rofimoji,clipboard:/home/yt/.config/rofi/scripts/cliphist.sh";
+    font: "hack 12";
+/*	location: 0;*/
+/*	yoffset: 0;*/
+/*	xoffset: 0;*/
+/*	fixed-num-lines: true;*/
+  	show-icons: true;
+  	terminal: "kitty";
+/*	ssh-client: "ssh";*/
+/*	ssh-command: "{terminal} -e {ssh-client} {host} [-p {port}]";*/
+/*	run-command: "{cmd}";*/
+/*	run-list-command: "";*/
+/*	run-shell-command: "{terminal} -e {cmd}";*/
+/*	window-command: "wmctrl -i -R {window}";*/
+/*	window-match-fields: "all";*/
+  	icon-theme: "Papirus";
+/*	drun-match-fields: "name,generic,exec,categories,keywords";*/
+/*	drun-categories: ;*/
+/*	drun-show-actions: false;*/
+/*	drun-display-format: "{name} [<span weight='light' size='small'><i>({generic})</i></span>]";*/
+/*	drun-url-launcher: "xdg-open";*/
+/*	disable-history: false;*/
+/*	ignored-prefixes: "";*/
+/*	sort: false;*/
+/*	sorting-method: "normal";*/
+/*	case-sensitive: false;*/
+/*	cycle: true;*/
+/*	sidebar-mode: false;*/
+/*	hover-select: false;*/
+/*	eh: 1;*/
+/*	auto-select: false;*/
+/*	parse-hosts: false;*/
+/*	parse-known-hosts: true;*/
+  	combi-modes: "window,run,calc,filebrowser";
+/*	matching: "normal";*/
+/*	tokenize: true;*/
+/*	m: "-5";*/
+/*	filter: ;*/
+/*	dpi: -1;*/
+/*	threads: 0;*/
+/*	scroll-method: 0;*/
+/*	window-format: "{w}    {c}   {t}";*/
+/*	click-to-exit: true;*/
+/*	global-kb: false;*/
+/*	max-history-size: 25;*/
+/*	combi-hide-mode-prefix: false;*/
+/*	combi-display-format: "{mode} {text}";*/
+/*	matching-negate-char: '-' /* unsupported */;*/
+/*	cache-dir: ;*/
+/*	window-thumbnail: false;*/
+/*	drun-use-desktop-cache: false;*/
+/*	drun-reload-desktop-cache: false;*/
+/*	normalize-match: false;*/
+/*	steal-focus: false;*/
+/*	application-fallback-icon: ;*/
+/*	refilter-timeout-limit: 300;*/
+/*	xserver-i300-workaround: false;*/
+/*	completer-mode: "recursivebrowser";*/
+/*	pid: "/run/user/1000/rofi.pid";*/
+/*	display-window: ;*/
+/*	display-run: ;*/
+/*	display-ssh: ;*/
+/*	display-drun: ;*/
+/*	display-combi: ;*/
+/*	display-keys: ;*/
+/*	display-filebrowser: ;*/
+/*	display-recursivebrowser: ;*/
+/*	kb-primary-paste: "Control+V,Shift+Insert";*/
+/*	kb-secondary-paste: "Control+v,Insert";*/
+/*	kb-secondary-copy: "Control+c";*/
+/*	kb-clear-line: "Control+w";*/
+/*	kb-move-front: "Control+a";*/
+/*	kb-move-end: "Control+e";*/
+/*	kb-move-word-back: "Alt+b,Control+Left";*/
+/*	kb-move-word-forward: "Alt+f,Control+Right";*/
+/*	kb-move-char-back: "Left,Control+b";*/
+/*	kb-move-char-forward: "Right,Control+f";*/
+/*	kb-remove-word-back: "Control+Alt+h,Control+BackSpace";*/
+/*	kb-remove-word-forward: "Control+Alt+d";*/
+/*	kb-remove-char-forward: "Delete,Control+d";*/
+/*	kb-remove-char-back: "BackSpace,Shift+BackSpace,Control+h";*/
+/*	kb-remove-to-eol: "Control+k";*/
+/*	kb-remove-to-sol: "Control+u";*/
+/*	kb-accept-entry: "Control+j,Control+m,Return,KP_Enter";*/
+/*	kb-accept-custom: "Control+Return";*/
+/*	kb-accept-custom-alt: "Control+Shift+Return";*/
+/*	kb-accept-alt: "Shift+Return";*/
+/*	kb-delete-entry: "Shift+Delete";*/
+/*	kb-mode-next: "Shift+Right,Control+Tab";*/
+/*	kb-mode-previous: "Shift+Left,Control+ISO_Left_Tab";*/
+/*	kb-mode-complete: "Control+l";*/
+/*	kb-row-left: "Control+Page_Up";*/
+/*	kb-row-right: "Control+Page_Down";*/
+/*	kb-row-up: "Up,Control+p";*/
+/*	kb-row-down: "Down,Control+n";*/
+/*	kb-row-tab: "";*/
+/*	kb-element-next: "Tab";*/
+/*	kb-element-prev: "ISO_Left_Tab";*/
+/*	kb-page-prev: "Page_Up";*/
+/*	kb-page-next: "Page_Down";*/
+/*	kb-row-first: "Home,KP_Home";*/
+/*	kb-row-last: "End,KP_End";*/
+/*	kb-row-select: "Control+space";*/
+/*	kb-screenshot: "Alt+S";*/
+/*	kb-ellipsize: "Alt+period";*/
+/*	kb-toggle-case-sensitivity: "grave,dead_grave";*/
+/*	kb-toggle-sort: "Alt+grave";*/
+/*	kb-cancel: "Escape,Control+g,Control+bracketleft";*/
+/*	kb-custom-1: "Alt+1";*/
+/*	kb-custom-2: "Alt+2";*/
+/*	kb-custom-3: "Alt+3";*/
+/*	kb-custom-4: "Alt+4";*/
+/*	kb-custom-5: "Alt+5";*/
+/*	kb-custom-6: "Alt+6";*/
+/*	kb-custom-7: "Alt+7";*/
+/*	kb-custom-8: "Alt+8";*/
+/*	kb-custom-9: "Alt+9";*/
+/*	kb-custom-10: "Alt+0";*/
+/*	kb-custom-11: "Alt+exclam";*/
+/*	kb-custom-12: "Alt+at";*/
+/*	kb-custom-13: "Alt+numbersign";*/
+/*	kb-custom-14: "Alt+dollar";*/
+/*	kb-custom-15: "Alt+percent";*/
+/*	kb-custom-16: "Alt+dead_circumflex";*/
+/*	kb-custom-17: "Alt+ampersand";*/
+/*	kb-custom-18: "Alt+asterisk";*/
+/*	kb-custom-19: "Alt+parenleft";*/
+/*	kb-select-1: "Super+1";*/
+/*	kb-select-2: "Super+2";*/
+/*	kb-select-3: "Super+3";*/
+/*	kb-select-4: "Super+4";*/
+/*	kb-select-5: "Super+5";*/
+/*	kb-select-6: "Super+6";*/
+/*	kb-select-7: "Super+7";*/
+/*	kb-select-8: "Super+8";*/
+/*	kb-select-9: "Super+9";*/
+/*	kb-select-10: "Super+0";*/
+/*	kb-entry-history-up: "Control+Up";*/
+/*	kb-entry-history-down: "Control+Down";*/
+/*	ml-row-left: "ScrollLeft";*/
+/*	ml-row-right: "ScrollRight";*/
+/*	ml-row-up: "ScrollUp";*/
+/*	ml-row-down: "ScrollDown";*/
+/*	me-select-entry: "MousePrimary";*/
+/*	me-accept-entry: "MouseDPrimary";*/
+/*	me-accept-custom: "Control+MouseDPrimary";*/
+  timeout {
+      action: "kb-cancel";
+      delay:  0;
+  }
+  filebrowser {
+      directories-first: true;
+      sorting-method:    "name";
+  }
+}

home/rofi/scripts/cliphist.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+tmp_dir="/tmp/cliphist"
+rm -rf "$tmp_dir"
+
+if [[ -n "$1" ]]; then
+    cliphist decode <<<"$1" | wl-copy
+    exit
+fi
+
+mkdir -p "$tmp_dir"
+
+read -r -d '' prog <<EOF
+/^[0-9]+\s<meta http-equiv=/ { next }
+match(\$0, /^([0-9]+)\s(\[\[\s)?binary.*(jpg|jpeg|png|bmp)/, grp) {
+    system("echo " grp[1] "\\\\\t | cliphist decode >$tmp_dir/"grp[1]"."grp[3])
+    print \$0"\0icon\x1f$tmp_dir/"grp[1]"."grp[3]
+    next
+}
+1
+EOF
+cliphist list | gawk "$prog"

home/sway/config

@@ -0,0 +1,155 @@
+set $mod Mod4
+set $alt Mod1
+set $left h
+set $down j
+set $up k
+set $right l
+
+set $term $HOME/.config/sway/scripts/terminal.sh
+set $menu rofi -show run
+set $screenshot grim -g "$(slurp)" - | wl-copy
+set $browser librewolf
+set $clipboard rofi -show clipboard -show-icons
+set $emoji rofi -show emoji
+
+set $font_family DejaVu Sans Mono
+set $font_size 11
+set $bg #000000
+set $fg #ffffff
+set $fgi #888888
+
+set $wallpaper $HOME/wallpapers/nixos-c-book-large.png
+set $lock swaylock -f -i $wallpaper
+output * bg $wallpaper fill
+
+floating_modifier $mod normal
+default_border pixel
+smart_borders on
+focus_follows_mouse always
+mouse_warping container
+
+bindsym $mod+Return exec $term
+bindsym $mod+Ctrl+q kill
+bindsym $mod+d exec $menu
+bindsym $mod+Shift+c reload
+bindsym $mod+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -B 'Yes, exit sway' 'swaymsg exit'
+bindsym Print exec $screenshot
+bindsym $mod+comma exec $clipboard
+bindsym $mod+period exec $emoji
+
+bindsym $mod+$alt+b exec $browser
+bindsym $mod+$alt+a exec anki
+bindsym $mod+$alt+f exec thunar
+bindsym $mod+$alt+e exec evolution
+bindsym $mod+p exec bitwarden
+bindsym $mod+$alt+m exec element-desktop
+
+bindsym $mod+$left focus left
+bindsym $mod+$down focus down
+bindsym $mod+$up focus up
+bindsym $mod+$right focus right
+
+bindsym $mod+Shift+$left move left
+bindsym $mod+Shift+$down move down
+bindsym $mod+Shift+$up move up
+bindsym $mod+Shift+$right move right
+
+bindsym $mod+1 workspace number 1
+bindsym $mod+2 workspace number 2
+bindsym $mod+3 workspace number 3
+bindsym $mod+4 workspace number 4
+bindsym $mod+5 workspace number 5
+bindsym $mod+6 workspace number 6
+bindsym $mod+7 workspace number 7
+bindsym $mod+8 workspace number 8
+bindsym $mod+9 workspace number 9
+bindsym $mod+0 workspace number 10
+
+bindsym $mod+Shift+1 move container to workspace number 1
+bindsym $mod+Shift+2 move container to workspace number 2
+bindsym $mod+Shift+3 move container to workspace number 3
+bindsym $mod+Shift+4 move container to workspace number 4
+bindsym $mod+Shift+5 move container to workspace number 5
+bindsym $mod+Shift+6 move container to workspace number 6
+bindsym $mod+Shift+7 move container to workspace number 7
+bindsym $mod+Shift+8 move container to workspace number 8
+bindsym $mod+Shift+9 move container to workspace number 9
+bindsym $mod+Shift+0 move container to workspace number 10
+
+# mouse side buttons
+bindsym --whole-window BTN_EXTRA exec ~/.config/sway/scripts/remote.sh btn1
+bindsym --whole-window BTN_SIDE exec ~/.config/sway/scripts/remote.sh
+
+bindsym $mod+b splith
+bindsym $mod+v splitv
+
+bindsym $mod+s layout stacking
+bindsym $mod+w layout tabbed
+bindsym $mod+e layout toggle split
+
+bindsym $mod+f fullscreen
+
+bindsym $mod+Shift+space floating toggle
+
+bindsym $mod+space focus mode_toggle
+
+bindsym $mod+a focus parent
+bindsym $mod+Shift+a focus child
+
+bindsym $mod+Shift+minus move scratchpad
+bindsym $mod+minus scratchpad show
+
+mode "resize" {
+    bindsym $left resize shrink width 10px
+    bindsym $down resize grow height 10px
+    bindsym $up resize shrink height 10px
+    bindsym $right resize grow width 10px
+    bindsym Return mode "default"
+    bindsym Escape mode "default"
+}
+bindsym $mod+r mode "resize"
+
+# keys to adjust volue and brightness
+bindsym --locked XF86AudioMute exec "amixer -q sset Master,0 toggle"
+bindsym --locked XF86AudioLowerVolume exec "amixer -q set Master 1%-"
+bindsym --locked XF86AudioRaiseVolume exec "amixer -q sset Master 1%+"
+bindsym --locked XF86MonBrightnessDown exec brightnessctl set 1%-
+bindsym --locked XF86MonBrightnessUp exec brightnessctl set 1%+
+
+# lockscreen
+bindsym $mod+Control+l exec $lock
+
+font pango:$font_family $font_size
+
+for_window [app_id=mpv] inhibit_idle visible, floating enable, sticky enable
+for_window [app_id="LibreWolf" title="^Extension"] floating enable
+for_window [floating] border csd
+for_window [app_id="Bitwarden"] floating enable
+
+bar {
+	swaybar_command waybar
+}
+
+input "type:touchpad" {
+    dwt enabled
+    tap enabled
+    natural_scroll enabled
+}
+
+input "type:keyboard" {
+  xkb_layout us
+  xkb_options ctrl:nocaps
+  xkb_numlock enabled
+}
+
+exec wl-paste --watch cliphist store
+exec mako >> $HOME/mako.log 2>&1
+exec dbus-update-activation-environment --all
+
+exec swayidle -w \
+  timeout 300 'swaymsg "output * power off"' \
+  timeout 305 $lock \
+  resume 'swaymsg "output * power on"' \
+  before-sleep 'playerctl pause; swaylock -f'
+
+exec system-dnotify --ready

home/sway/scripts/remote.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+active_window=$(swaymsg -t get_tree |jq -r '..|try select(.focused == true) |.app_id')
+
+if [ "$1" = "btn1" ]; then
+  if [ "$active_window" = "anki" ]; then
+    wtype " "
+  elif [ "$active_window" = "foot" ]; then
+    wtype -M ctrl -M shift -k c -m ctrl -m shift
+  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
+    wtype -M alt -P right -p right -m alt
+  else
+    wtype -M ctrl -k c -m ctrl
+  fi
+else
+  if [ "$active_window" = "anki" ]; then
+    wtype "1"
+  elif [ "$active_window" = "foot" ]; then
+    wtype -M ctrl -M shift -k v
+    wtype -m ctrl
+  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
+    wtype -M alt -P left -p left -m alt
+  else
+    wtype -M ctrl -k v
+    wtype -m ctrl
+  fi
+fi

home/sway/scripts/terminal.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+focused_workspace=$(swaymsg -t get_workspaces | jq '.[] | select(.focused == true) | .num')
+
+foot_window_count=$(swaymsg -t get_tree | jq --argjson workspace "$focused_workspace" '[recurse(.nodes[]?) | select(.type == "workspace" and .num == $workspace) | recurse(.nodes[]?) | select(.app_id == "foot")] | length')
+
+next_session=$((focused_workspace * 10))
+
+if [ "$foot_window_count" -gt 0 ]
+then
+  next_session=$((next_session + foot_window_count))
+fi
+
+foot tmux new-session -A -s ${next_session}

home/waybar/config

@@ -0,0 +1,81 @@
+{
+  "layer": "top", // Waybar on highest layer so tooltips go over windows
+    "output": "eDP-1", // Set output to primary monitor
+    "height": 40, // Set height to avoid jumping due to active workspace indicator
+		
+		"margin-left": 0,
+		"margin-right": 0,
+		"margin-top": 0,
+    "modules-left": ["sway/workspaces", "clock#time", "clock#date", "battery"], // Sets modules for the left of the bar
+    "modules-center": ["sway/window"], // Set modules for the center of the bar
+    "modules-right": ["tray", "temperature", "cpu", "memory", "wireplumber"], // Set modules for the right of the bar
+    "clock#time": {
+    "format": "<span color=\"#7aa2f7\"> </span>{:%H:%M:%S}",
+    "interval": 1,
+  },
+  "clock#date": {
+    "format": "<span color=\"#7aa2f7\"> </span>{:%Y/%m/%d}",
+    "tooltip-format": "<tt>{calendar}</tt>",
+    "interval": 360,
+    "calendar": {
+      "mode": "month",
+      "mode-mon-col": 4,
+      "weeks-pos": "right",
+      "on-scroll": 1,
+      "on-click-right": "mode",
+      "format": {
+        "months": "<span color='#c0caf5'><b>{}</b></span>",
+        "days": "<span color='#c0caf5'><b>{}</b></span>",
+        "weeks": "<span color='#7dcfff'><b>W{}</b></span>",
+        "weekdays": "<span color='#ff9e64'><b>{}</b></span>",
+        "today": "<span color='#f7768e'><b><u>{}</u></b></span>",
+      },
+    },
+  },
+  "battery": {
+    "interval": 60,
+    "states": {
+      "warning": 40,
+      "critical": 20,
+    },
+    "format": "{icon} {capacity}%",
+    "format-icons": [
+      "<span color=\"#f7768e\"> </span>",
+      "<span color=\"#f7768e\"> </span>",
+      "<span color=\"#7aa2f7\"> </span>",
+      "<span color=\"#7aa2f7\"> </span>",
+      "<span color=\"#7aa2f7\"> </span>",
+    ],
+    "format-charging": "<span color=\"#e0af68\">󱐌</span> {capacity}%",
+  },
+  "cpu": {
+    "format": "<span color=\"#7aa2f7\"> </span>{usage}%",
+    "interval": 4,
+  },
+  "memory": {
+    "format": "<span color=\"#7aa2f7\"> </span>{used}GiB",
+    "interval": 4,
+  },
+  "temperature": {
+    "hwmon-path": "/sys/class/hwmon/hwmon4/temp1_input",
+    "critical-threshold": 80,
+    "format": "<span color=\"#7aa2f7\"> </span>{temperatureC}°C",
+    "format-critical": "<span color=\"#f7768e\"> </span>{temperatureC}°C",
+    "interval": 4,
+  },
+  "wireplumber": {
+    "scroll-step": 1, // %, can be a float
+    "format": "<span color=\"#7aa2f7\">{icon} </span>{volume}%",
+    "format-muted": "<span color=\"#f7768e\">󰝟 </span>Muted",
+    "format-icons": ["", "", ""],
+    "on-click": "pavucontrol",
+		"interval": 4,
+  },
+  "sway/window": {
+    "max-length": 64,
+  },
+  "tray": {
+    "icon-size": 22,
+    "spacing": 6,
+  }
+}

home/waybar/style.css

@@ -0,0 +1,70 @@
+.module,
+#clock.date,
+#clock.time,
+#workspaces button {
+  background: transparent;
+  padding: 0 10px;
+  font-family: RobotoMono Nerd Font;
+  font-weight: 900;
+  font-size: 13pt;
+  color: #c0caf5;
+}
+
+/* main waybar */
+window#waybar {
+  background: rgba(26, 27, 38, 1);
+	border: 2px solid #414868;
+}
+
+/* when hovering over modules */
+tooltip {
+  background: #1e1e2e;
+  border-radius: 0;
+}
+
+#workspaces {
+	padding-right: 0;
+}
+
+#workspaces button {
+  padding: 2px;
+}
+
+#clock {
+	padding-right: 100px;
+}
+
+
+/* Sets active workspace to have a solid line on the bottom */
+#workspaces button.focused {
+  border-bottom: 2px solid #7aa2f7;
+  border-radius: 0;
+	margin-top: 0px;
+  transition: none;
+}
+
+/* More workspace stuff for highlighting on hover */
+#workspaces button.focused {
+  color: #a6adc8;
+}
+
+#workspaces button.urgent {
+  color: #f7768e;
+}
+
+#workspaces button:hover {
+  background: #11111b;
+  color: #cdd6f4;
+}
+
+/* Hide window module when not focused on window or empty workspace */
+window#waybar.empty #window {
+  padding: 0;
+  margin: 0;
+  opacity: 0;
+}
+
+/* Set up rounding to make these modules look like separate pills */
+#tray {
+  margin-right: 4px;
+}

home/yt/chunk.nix

@@ -14,4 +14,9 @@
   programs.home-manager.enable = true;
 
   systemd.user.startServices = "sd-switch";
+
+  home.packages = with pkgs; [
+    foot.terminfo
+    attic-server
+  ];
 }

home/yt/common.nix

@@ -9,6 +9,10 @@
     "EDITOR" = "nvim";
   };
 
+  xdg.configFile = {
+    nvim.source = ../nvim;
+  };
+
   home.packages = with pkgs; [
     man-pages
     man-pages-posix
@@ -26,17 +30,17 @@
   };
   programs.zoxide.enable = true;
   programs.eza.enable = true;
+  programs.neovim.enable = true;
   programs.git = {
     enable = true;
     userName = "cy";
-    userEmail = "cy@cy7.sh";
+    userEmail = "hi@cything.io";
     delta = {
-      enable = false;
+      enable = true;
       options = {
         navigate = true;
       };
     };
-    difftastic.enable = true;
     extraConfig = {
       init.defaultBranch = "main";
       push.autoSetupRemote = true; # assume -u on first push
@@ -44,11 +48,7 @@
         rebase = true;
         autostash = true;
       };
-      merge = {
+      merge.tool = "vimdiff";
-        tool = "vimdiff";
-        keepBackup = false;
-        prompt = false;
-      };
       rebase = {
         stat = true;
         autoStash = true;
@@ -56,20 +56,12 @@
         updateRefs = true;
       };
       help.autocorrect = 1;
-      "mergetool \"vimdiff\"".cmd = "nvim -d $LOCAL $REMOTE $MERGED -c '$wincmd w' -c 'wincmd J'";
+      mergetool = {
-      url = {
+        prompt = false;
-        "ssh://git@github.com/" = {
+        path = "nvim-open";
-          insteadOf = [
-            "https://github.com/"
-            "github:"
-            "gh:"
-          ];
-        };
       };
     };
   };
   programs.ripgrep.enable = true;
-  # programs.man.generateCaches = true; # slows down eval
+  programs.man.generateCaches = true;
-  programs.fd.enable = true;
-  news.display = "silent";
 }

home/yt/ytnix.nix

@@ -1,14 +1,11 @@
 {
   pkgs,
-  lib,
   ...
 }:
 {
   imports = [
     ./common.nix
-    ../irssi.nix
+    ../foot.nix
-    ../kitty.nix
-    ../codium.nix
   ];
   home = {
     username = "yt";
@@ -17,151 +14,128 @@
   };
   programs.home-manager.enable = true;
 
-  home.pointerCursor = {
+  systemd.user.startServices = "sd-switch";
-    package = pkgs.bibata-cursors;
+
-    name = "Bibata-Modern-Classic";
+  qt = {
-    size = 23;
+    enable = true;
-    gtk.enable = true;
+    platformTheme.name = "gtk";
-    x11.enable = true;
+    style.name = "adwaita-dark";
+    style.package = pkgs.adwaita-qt;
   };
 
-  home.packages =
+  gtk = {
-    with pkgs;
+    enable = true;
-    lib.flatten [
+    cursorTheme = {
+      package = pkgs.bibata-cursors;
+      name = "Bibata-Modern";
+    };
+    theme = {
+      package = pkgs.adw-gtk3;
+      name = "adw-gtk3-dark";
+    };
+    iconTheme = {
+      package = pkgs.adwaita-icon-theme;
+      name = "Adwaita";
+    };
+  };
+
+  home.sessionVariables = {
+    ANKI_WAYLAND = "1";
+  };
+
+  home.packages = with pkgs; [
+    firefox
     ungoogled-chromium
     librewolf
     bitwarden-desktop
     bitwarden-cli
     fastfetch
-      (with kdePackages; [
+    discord
-        gwenview
+    nwg-look
-        okular
+    element-desktop
-      ])
+    kdePackages.gwenview
+    kdePackages.okular
+    kdePackages.qtwayland
     mpv
+    yt-dlp
     signal-desktop
+    azure-cli
+    pavucontrol
     btop
+    grim
+    slurp
+    rofi-wayland
+    rofimoji
+    cliphist
     jq
+    bash-language-server
     sqlite
     usbutils
+    clang-tools
     calibre
     tor-browser
     wtype
     bat
+    yarn
     rclone
     go
-      (rust-bin.selectLatestNightlyWith (
+    rustup
-        toolchain:
-        toolchain.default.override {
-          extensions = [ "rust-src" ];
-        }
-      ))
     pwgen
+    lua-language-server
     gnumake
+    foot
+    minisign
     unzip
-      anki-bin
+    lm_sensors
-      trezorctl
+    sshfs
-      q
+    python312Packages.python-lsp-server
-      gdb
-      fuzzel
-      hugo
-      ghidra
-      sccache
-      awscli2
-      (cutter.withPlugins (
-        p: with p; [
-          rz-ghidra
-          jsdec
-          sigdb
-        ]
-      ))
-      p7zip
-      qbittorrent
-      android-tools
-      frida-tools
-      mitmproxy
-      (python313.withPackages (
-        p: with p; [
-          python-lsp-server
-          pip
-          virtualenv
-        ]
-      ))
-      jadx
-      scrcpy
-      syncthing
-      syncthingtray
-      (with llvmPackages; [
-        clangUseLLVM
-        compiler-rt
-        libllvm
-      ])
-      nix-output-monitor
-      wl-clipboard-rs
-      pixelflasher
-      cinny-desktop
-      freetube
     gopls
-      rust-analyzer
+    anki
-      minio-client
+    trezorctl
-      nil
+    trezor-agent
-      keepassxc
+    q
-    ];
+    opentofu
-
+    terraform-ls
-  home.sessionVariables = {
+    gdb
-    # to make ghidra work on xwayland
+    gcc
-    _JAVA_AWT_WM_NONREPARENTING = 1;
+    seahorse
-
-    # sccache stuff
-    RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
-    SCCACHE_BUCKET = "sccache";
-    SCCACHE_REGION = "us-east-1";
-    SCCACHE_ENDPOINT = "https://s3.cy7.sh";
-    SCCACHE_ALLOW_CORE_DUMPS = "true";
-    SCCACHE_S3_USE_SSL = "true";
-    SCCACHE_CACHE_MULTIARCH = "true";
-    SCCACHE_LOG = "warn";
-    AWS_DEFAULT_REGION = "us-east-1";
-    AWS_ENDPOINT_URL = "https://s3.cy7.sh";
-    AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";
-    AWS_SECRET_ACCESS_KEY = "$(cat /run/secrets/aws/key_secret)";
-  };
-
-  home.sessionPath = [
-    "$HOME/.cargo/bin"
-    "$HOME/go/bin"
   ];
 
+  programs.waybar.enable = true;
   programs.feh.enable = true;
 
+  services.mako = {
+    enable = true;
+    backgroundColor = "#1a1a1a";
+    defaultTimeout = 5000;
+    borderSize = 0;
+    borderRadius = 10;
+    font = "DejaVu Sans Mono 11";
+    padding = "10";
+    textColor = "#ffffff";
+    extraConfig = ''
+      [urgency=high]
+      background-color=#c00000
+      border-color=#ff0000
+    '';
+  };
+
   xdg.configFile = {
+    sway.source = ../sway;
+    rofi.source = ../rofi;
+    waybar.source = ../waybar;
     mpv.source = ../mpv;
   };
 
-  programs.direnv = {
+  programs.newsboat = {
     enable = true;
-    nix-direnv.enable = true;
+    extraConfig = ''
+      urls-source "miniflux"
+      miniflux-url "https://rss.cything.io/"
+      miniflux-login "cy"
+      miniflux-passwordfile /run/secrets/newsboat/miniflux
+    '';
   };
 
-  programs.git.extraConfig = {
+  services.gnome-keyring.enable = true;
-    user = {
-      signingKey = "~/.ssh/id_ed25519";
-    };
-    gpg.format = "ssh";
-    commit.gpgsign = true;
-  };
-
-  programs.nix-index-database.comma.enable = true;
-
-  programs.neovim = {
-    enable = true;
-    viAlias = true;
-    vimAlias = true;
-  };
-
-  programs.ssh = {
-    enable = true;
-    addKeysToAgent = "yes";
-  };
-
-  programs.firefox.enable = true;
 }

home/zsh/default.nix

@@ -36,22 +36,19 @@
       searchUpKey = "^p";
       searchDownKey = "^n";
     };
-
-    # prezto = {
-    #   enable = true;
-    #   caseSensitive = false;
-    #   editor.keymap = "vi";
-    # };
-
     initExtra = ''
       # disable control+s to pause terminal
       unsetopt FLOW_CONTROL
+      # manually integrate fzf cause we need to make sure zsh-vi-mode
+      # won't override C-r
+      function zvm_after_init() {
+        eval "$(${pkgs.fzf}/bin/fzf --zsh)"
+      }
 
       # useful emacs mode bindings
       bindkey -M viins "^E" end-of-line
       bindkey -M viins "^A" beginning-of-line
       bindkey -M viins "^B" backward-char
-      bindkey -M viins "^F" forward-char
 
       # accept one word completion
       bindkey -M viins "^S" forward-word
@@ -90,9 +87,9 @@
       "ta" = "tmux new-session -A -s";
       "se" = "sudoedit";
       "s" = "sudo";
-      "nrs" = "sudo nixos-rebuild switch -L --flake . --log-format internal-json -v |& nom --json";
+      "nrs" = "sudo nixos-rebuild switch --flake .";
-      "nrt" = "sudo nixos-rebuild test -L --flake . --log-format internal-json -v |& nom --json";
+      "nrt" = "sudo nixos-rebuild test --flake .";
-      "hrs" = "home-manager switch -L --flake .";
+      "hrs" = "home-manager switch --flake .";
       "g" = "git";
       "ga" = "git add";
       "gaa" = "git add --all";
@@ -112,13 +109,11 @@
       "grv" = "git remote --verbose";
       "gs" = "git status --short";
       "gss" = "git status";
-      "code" = "codium";
     };
   };
 
   programs.fzf.enableZshIntegration = true;
   programs.zoxide.enableZshIntegration = true;
   programs.eza.enableZshIntegration = true;
-  programs.nix-index.enableZshIntegration = true;
+  programs.nix-index.enableZshIntegration = false;
-  programs.direnv.enableZshIntegration = true;
 }

hosts/chunk/Caddyfile

@@ -0,0 +1,67 @@
+{
+  acme_ca https://acme.zerossl.com/v2/DV90
+  acme_eab {
+    key_id {$EAB_KEY_ID}
+    mac_key {$EAB_MAC_KEY}
+  }
+}
+
+(common) {
+  encode zstd gzip
+  header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+}
+
+git.cy7.sh, git.cything.io {
+  import common
+  reverse_proxy unix//run/gitlab/gitlab-workhorse.socket
+}
+
+rss.cything.io {
+  import common
+  reverse_proxy localhost:8080
+}
+
+photos.cy7.sh {
+  import common
+  reverse_proxy localhost:2283
+}
+
+chat.cything.io {
+  import common
+  reverse_proxy localhost:8448
+}
+
+pass.cy7.sh {
+  import common
+  reverse_proxy localhost:8081
+}
+
+dns.cything.io {
+  import common
+  reverse_proxy localhost:8082
+}
+
+pad.cything.io {
+  import common
+  reverse_proxy localhost:8085
+}
+
+red.cything.io {
+  import common
+  reverse_proxy localhost:8087
+}
+
+grafana.cything.io {
+  import common
+  reverse_proxy localhost:8088
+}
+
+element.cything.io {
+  import common
+  reverse_proxy localhost:8089
+}
+
+cache.cything.io {
+  import common
+  reverse_proxy localhost:8090
+}

hosts/chunk/adguard.nix

@@ -0,0 +1,24 @@
+{ ... }:
+{
+  services.adguardhome = {
+    enable = true;
+    host = "127.0.0.1";
+    port = 8082;
+    settings = {
+      http.port = "8083";
+      users = [
+        {
+          name = "cy";
+          password = "$2y$10$BZy2zYJj5z4e8LZCq/GwuuhWUafL/MNFO.YcsAMmpDS.2krPxi7KC";
+        }
+      ];
+      # do not listen eveywhere cause podman runs it's own DNS
+      dns.bind_hosts = [
+        "127.0.0.1"
+        "::1"
+        "31.59.129.225"
+        "2a0f:85c1:840:2bfb::1"
+      ];
+    };
+  };
+}

hosts/chunk/attic.nix

@@ -0,0 +1,34 @@
+{ config, ... }:
+{
+  services.atticd = {
+    enable = true;
+
+    environmentFile = config.sops.secrets."attic/env".path;
+
+    settings = {
+      listen = "[::]:8090";
+      api-endpoint = "https://cache.cything.io/";
+      allowed-hosts = [ "cache.cything.io" ];
+      require-proof-of-possession = false;
+      compression.type = "zstd";
+      database.url = "postgresql:///atticd?host=/run/postgresql";
+
+      storage = {
+        type = "local";
+        path = "/mnt/attic";
+      };
+
+      garbage-collection = {
+        default-retention-period = "3 months";
+      };
+
+      chunking = {
+        nar-size-threshold = 0; # disables chunking
+        min-size = 0;
+        avg-size = 0;
+        max-size = 0;
+        concurrent-chunk-uploads = 32;
+      };
+    };
+  };
+}

hosts/chunk/conduit.nix

@@ -0,0 +1,40 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  virtualisation.oci-containers.containers.conduit = {
+    image = "ghcr.io/girlbossceo/conduwuit:main";
+    autoStart = true;
+    ports = [ "127.0.0.1:8448:8448" ];
+    pull = "newer";
+    environment = {
+      CONDUWUIT_SERVER_NAME = "cything.io";
+      CONDUWUIT_DATABASE_PATH = "/var/lib/conduwuit";
+      CONDUWUIT_PORT = "8448";
+      CONDUWUIT_MAX_REQUEST_SIZE = "20000000"; # in bytes ~20MB
+      CONDUWUIT_ALLOW_REGISTRATION = "false";
+      CONDUWUIT_ALLOW_FEDERATION = "true";
+      CONDUWUIT_ALLOW_CHECK_FOR_UPDATES = "true";
+      CONDUWUIT_TRUSTED_SERVERS = ''["matrix.org"]'';
+      CONDUWUIT_ADDRESS = "0.0.0.0";
+      # CONDUIT_CONFIG = "";
+    };
+    volumes = [
+      "/opt/conduit/db:/var/lib/conduwuit/"
+    ];
+    networks = [ "conduit-net" ];
+  };
+
+  systemd.services.create-conduit-net = {
+    serviceConfig.Type = "oneshot";
+    wantedBy = with config.virtualisation.oci-containers; [
+      "${backend}-conduit.service"
+    ];
+    script = ''
+      ${pkgs.podman}/bin/podman network exists conduit-net || \
+      ${pkgs.podman}/bin/podman network create conduit-net
+    '';
+  };
+}

hosts/chunk/conduwuit.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  services.conduwuit = {
+    enable = true;
+    settings.global = {
+      port = [ 8448 ];
+      server_name = "cything.io";
+      allow_check_for_updates = true;
+    };
+  };
+}

hosts/chunk/default.nix

@@ -1,6 +1,7 @@
 {
-  pkgs,
+  config,
   lib,
+  pkgs,
   ...
 }:
 {
@@ -8,18 +9,22 @@
     ../common.nix
     ../zsh.nix
     ./hardware-configuration.nix
+    ./gitlab.nix
     ./backup.nix
     ./rclone.nix
     ./postgres.nix
+    ./wireguard.nix
+    ./adguard.nix
     ./hedgedoc.nix
     ./miniflux.nix
     ./redlib.nix
     ./vaultwarden.nix
+    ./wireguard.nix
     ./grafana.nix
+    ./conduwuit.nix
     ./immich.nix
-    ./forgejo.nix
+    ./element.nix
-    ./garage.nix
+    ./attic.nix
-    ./tailscale.nix
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -27,6 +32,9 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/chunk.yaml;
     };
+    "services/ntfy" = {
+      sopsFile = ../../secrets/services/ntfy.yaml;
+    };
     "rclone/config" = {
       sopsFile = ../../secrets/rclone.yaml;
     };
@@ -39,74 +47,73 @@
     "hedgedoc/env" = {
       sopsFile = ../../secrets/services/hedgedoc.yaml;
     };
+    "wireguard/private" = {
+      sopsFile = ../../secrets/wireguard/chunk.yaml;
+    };
+    "wireguard/psk-yt" = {
+      sopsFile = ../../secrets/wireguard/chunk.yaml;
+    };
+    "wireguard/psk-phone" = {
+      sopsFile = ../../secrets/wireguard/chunk.yaml;
+    };
     "miniflux/env" = {
       sopsFile = ../../secrets/services/miniflux.yaml;
     };
+    "gitlab/root" = {
+      sopsFile = ../../secrets/services/gitlab.yaml;
+      owner = config.users.users.git.name;
+    };
+    "gitlab/secret" = {
+      sopsFile = ../../secrets/services/gitlab.yaml;
+      owner = config.users.users.git.name;
+    };
+    "gitlab/jws" = {
+      sopsFile = ../../secrets/services/gitlab.yaml;
+      owner = config.users.users.git.name;
+    };
+    "gitlab/db" = {
+      sopsFile = ../../secrets/services/gitlab.yaml;
+      owner = config.users.users.git.name;
+    };
+    "gitlab/otp" = {
+      sopsFile = ../../secrets/services/gitlab.yaml;
+      owner = config.users.users.git.name;
+    };
     "rsyncnet/id_ed25519" = {
       sopsFile = ../../secrets/zh5061/chunk.yaml;
     };
-    "garage/env" = {
+    "attic/env" = {
-      sopsFile = ../../secrets/services/garage.yaml;
+      sopsFile = ../../secrets/services/attic.yaml;
-    };
-    "tailscale/auth" = {
-      sopsFile = ../../secrets/services/tailscale.yaml;
-    };
-    "karakeep/env" = {
-      sopsFile = ../../secrets/services/karakeep.yaml;
     };
   };
 
-  boot = {
+  boot.loader.grub.enable = true;
-    loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/vda";
-    loader.grub.device = "/dev/vda";
-    kernelPackages = pkgs.linuxPackages_latest;
-  };
 
   system.stateVersion = "24.05";
 
   # network stuff
-  networking = {
+
-    hostName = "chunk";
+  networking.hostName = "chunk";
-    networkmanager.enable = true;
+  networking.networkmanager.enable = true;
-    firewall = {
+  networking.firewall = {
     enable = true;
-      trustedInterfaces = [ "tailscale0" ];
     allowedTCPPorts = [
       22
       80
       443
+      53
+      853
     ];
     allowedUDPPorts = [
       443
-      ];
+      51820
-      extraCommands =
+      53
-        let
+      853
-          ethtool = lib.getExe pkgs.ethtool;
+    ]; # 51820 is wireguard
-          tc = lib.getExe' pkgs.iproute2 "tc";
+    trustedInterfaces = [ "wg0" ];
-        in
-        ''
-          # disable TCP segmentation offload (https://wiki.archlinux.org/title/Advanced_traffic_control#Prerequisites)
-          ${ethtool} -K ens18 tso off
-
-          # clear existing rules
-          ${tc} qdisc del dev ens18 root || true
-
-          # create HTB hierarchy
-          ${tc} qdisc add dev ens18 root handle 1: htb default 10
-          ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
-          # rest
-          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 60% ceil 100%
-          # caddy
-          ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%
-
-          # mark traffic
-          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 3
-
-          # route marked packets
-          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 3 fw flowid 1:30
-        '';
   };
-    interfaces.ens18 = {
+  networking.interfaces.ens18 = {
     ipv6.addresses = [
       {
         address = "2a0f:85c1:840:2bfb::1";
@@ -120,14 +127,19 @@
       }
     ];
   };
-    defaultGateway6 = {
+  networking.defaultGateway6 = {
     address = "2a0f:85c1:840::1";
     interface = "ens18";
   };
-    defaultGateway = {
+  networking.defaultGateway = {
     address = "31.59.129.1";
     interface = "ens18";
   };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
   };
 
   users.users.yt = {
@@ -137,23 +149,14 @@
       "podman"
     ];
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
     ];
   };
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
   ];
-  # for forgejo
-  users.users.git = {
-    isNormalUser = true;
-    home = "/var/lib/forgejo";
-    group = "git";
-  };
-  users.groups.git = { };
 
   environment.systemPackages = with pkgs; [
     vim
@@ -163,6 +166,7 @@
     tmux
     file
     sops
+    attic-server
   ];
 
   environment.variables = {
@@ -178,13 +182,27 @@
   security.sudo.enable = true;
   security.sudo.wheelNeedsPassword = false;
 
+  programs.gnupg.agent.enable = true;
   programs.git.enable = true;
 
-  my.caddy.enable = true;
+  services.caddy = {
-  my.containerization.enable = true;
+    enable = true;
-  my.authelia.enable = true;
+    configFile = ./Caddyfile;
-  my.karakeep = {
+    environmentFile = config.sops.secrets."caddy/env".path;
-    enable = false;
+    logFormat = lib.mkForce "level INFO";
-    dataDir = "/opt/karakeep";
   };
+
+  # container stuff
+  virtualisation.containers.enable = true;
+  virtualisation.podman = {
+    enable = true;
+    # create 'docker' alias for podman, to use as
+    # drop-in replacement
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      dns_enabled = true;
+      ipv6_enabled = true;
+    };
+  };
+  virtualisation.oci-containers.backend = "podman";
 }

hosts/chunk/deluge.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  services.deluge = {
+    enable = true;
+    web = {
+      enable = true;
+      port = 8112;
+    };
+  };
+}

hosts/chunk/element.nix

@@ -0,0 +1,25 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  virtualisation.oci-containers.containers.element = {
+    image = "vectorim/element-web";
+    autoStart = true;
+    ports = [ "127.0.0.1:8089:80" ];
+    pull = "newer";
+    networks = [ "element-net" ];
+  };
+
+  systemd.services.create-element-net = {
+    serviceConfig.Type = "oneshot";
+    wantedBy = with config.virtualisation.oci-containers; [
+      "${backend}-element.service"
+    ];
+    script = ''
+      ${pkgs.podman}/bin/podman network exists element-net || \
+      ${pkgs.podman}/bin/podman network create element-net
+    '';
+  };
+}

hosts/chunk/forgejo.nix

@@ -1,53 +0,0 @@
-{ pkgs, ... }:
-{
-  services.forgejo = {
-    enable = true;
-    package = pkgs.forgejo; # uses forgejo-lts by default
-    user = "git";
-    group = "git";
-    settings = {
-      server = {
-        ROOT_URL = "https://git.cy7.sh";
-        HTTP_PORT = 3000;
-        HTTP_ADDR = "127.0.0.1";
-        DOMAIN = "git.cy7.sh";
-        LANDING_PAGE = "explore";
-      };
-      session.COOKIE_SECURE = true;
-      service.DISABLE_REGISTRATION = true;
-      ui = {
-        AMBIGUOUS_UNICODE_DETECTION = false;
-        DEFAULT_THEME = "forgejo-dark";
-      };
-      actions.ENABLED = false;
-      repository.ENABLE_PUSH_CREATE_USER = true;
-      indexer.REPO_INDEXER_ENABLED = true;
-    };
-    database = {
-      type = "postgres";
-      socket = "/run/postgresql";
-      user = "git";
-      name = "git";
-    };
-  };
-
-  services.caddy.virtualHosts."git.cy7.sh".extraConfig = ''
-    import common
-
-    # renamed repo
-    uri replace /cy/infra /cy/nixos-config
-
-    reverse_proxy localhost:3000
-  '';
-  services.caddy.virtualHosts."git.cything.io".extraConfig = ''
-    import common
-
-    # wrap in route so things are evaluated in the order written
-    route {
-      # rewrite gitlab URIs to make it work with forgejo
-      uri path_regexp /-/ /
-      uri replace /blob/ /src/
-      redir https://git.cy7.sh{uri} permanent
-    }
-  '';
-}

hosts/chunk/garage.nix

@@ -1,59 +0,0 @@
-{ config, pkgs, ... }:
-{
-  services.garage = {
-    enable = true;
-    package = pkgs.garage;
-    settings = {
-      data_dir = "/mnt/garage";
-      s3_api = {
-        s3_region = "us-east-1";
-        api_bind_addr = "[::]:3900";
-        root_domain = "s3.cy7.sh";
-      };
-      s3_web = {
-        bind_addr = "[::]:3902";
-        root_domain = ".web.cy7.sh";
-        add_host_to_metrics = true;
-      };
-      admin.api_bind_addr = "[::]:3903";
-      rpc_bind_addr = "[::]:3901";
-      rpc_public_addr = "100.122.132.30:3901";
-      replication_factor = 1;
-      db_engine = "lmdb";
-      disable_scrub = true;
-      block_size = "128M";
-      compression_level = "none";
-    };
-    environmentFile = config.sops.secrets."garage/env".path;
-    logLevel = "warn";
-  };
-
-  services.caddy.virtualHosts = {
-    "s3.cy7.sh" = {
-      serverAliases = [ "*.s3.cy7.sh" ];
-      extraConfig = ''
-        import common
-        reverse_proxy localhost:3900
-      '';
-    };
-    "admin.s3.cy7.sh".extraConfig = ''
-      import common
-      reverse_proxy localhost:3903
-    '';
-    "*.web.cy7.sh" = {
-      serverAliases = [ "nixcache.cy7.sh" "staging.cy7.sh" ];
-      extraConfig = ''
-        import common
-        @plain {
-          host nixcache.cy7.sh nixcache.web.cy7.sh
-          path / /nix-cache-info
-        }
-        header @plain {
-          >content-type text/plain
-        }
-
-        reverse_proxy localhost:3902
-      '';
-    };
-  };
-}

hosts/chunk/gitlab.nix

@@ -0,0 +1,35 @@
+{ config, ... }:
+{
+  services.gitlab = {
+    enable = true;
+    https = true;
+    host = "git.cything.io";
+    user = "git"; # so that you can ssh with git@git.cything.io
+    group = "git";
+    port = 443; # this *not* the port gitlab will run on
+    puma.workers = 0; # https://docs.gitlab.com/omnibus/settings/memory_constrained_envs.html#optimize-puma
+    sidekiq.concurrency = 5;
+    databaseUsername = "git"; # needs to be same as user
+    initialRootEmail = "hi@cything.io";
+    initialRootPasswordFile = config.sops.secrets."gitlab/root".path;
+    secrets = {
+      secretFile = config.sops.secrets."gitlab/secret".path;
+      otpFile = config.sops.secrets."gitlab/otp".path;
+      jwsFile = config.sops.secrets."gitlab/jws".path;
+      dbFile = config.sops.secrets."gitlab/db".path;
+    };
+    backup = {
+      startAt = "daily";
+      # we already postgresqlbackup.service
+      skip = [ "db" ];
+      keepTime = 48; # hours
+    };
+    extraConfig = {
+      gitlab = {
+        # NOTE: default_syntax_highlighting_theme needs to be set in the application_settings table in the database
+        default_color_mode = 2;
+      };
+      prometheus.enabled = false;
+    };
+  };
+}

hosts/chunk/grafana.nix

@@ -7,7 +7,7 @@
       http_port = 8088;
       enforce_domain = true;
       enable_gzip = true;
-      domain = "grafana.cy7.sh";
+      domain = "grafana.cything.io";
     };
     settings.analytics.reporting_enabled = false;
   };
@@ -29,20 +29,6 @@
           }
         ];
       }
-      {
-        job_name = "garage";
-        static_configs = [
-          {
-            targets = [ "127.0.0.1:3903" ];
-          }
-        ];
-      }
     ];
   };
-
-  services.caddy.virtualHosts."grafana.cy7.sh".extraConfig = ''
-    import common
-    import authelia
-    reverse_proxy localhost:8088
-  '';
 }

hosts/chunk/hedgedoc.nix

@@ -11,14 +11,9 @@
         dialect = "postgresql";
       };
       port = 8085;
-      domain = "pad.cy7.sh";
+      domain = "pad.cything.io";
       allowEmailRegister = false;
       protocolUseSSL = true;
     };
   };
-
-  services.caddy.virtualHosts."pad.cy7.sh".extraConfig = ''
-    import common
-    reverse_proxy localhost:8085
-  '';
 }

hosts/chunk/immich.nix

@@ -1,15 +1,13 @@
 {
   pkgs,
   config,
-  lib,
   ...
 }:
 let
   uploadLocation = "/mnt/photos/immich";
-  # thumbsLocation = "/opt/immich/thumbs";
+  thumbsLocation = "/opt/immich/thumbs";
   profileLocation = "/opt/immich/profile";
   dbDataLocation = "/opt/immich/postgres";
-  backupsLocation = "/opt/immich/backups";
 in
 {
   virtualisation.oci-containers.containers = {
@@ -20,9 +18,8 @@ in
       pull = "newer";
       volumes = [
         "${uploadLocation}:/usr/src/app/upload"
-        # "${thumbsLocation}:/usr/src/app/upload/thumbs"
+        "${thumbsLocation}:/usr/src/app/upload/thumbs"
         "${profileLocation}:/usr/src/app/upload/profile"
-        "${backupsLocation}:/usr/src/app/upload/backups"
       ];
       environment = {
         REDIS_HOSTNAME = "immich-redis";
@@ -70,9 +67,21 @@ in
       ];
       networks = [ "immich-net" ];
     };
+
+    # immich-ml = {
+    #   image = "ghcr.io/immich-app/immich-machine-learning:release";
+    #   autoStart = true;
+    #   pull = "newer";
+    #   environment = {
+    #     REDIS_HOSTNAME = "immich-redis";
+    #     DB_HOSTNAME = "immich-db";
+    #   };
+    #   volumes = [ "${modelCache}:/cache" ];
+    #   networks = [ "immich-net" ];
+    # };
   };
 
-  systemd.services.create-immich-net = rec {
+  systemd.services.create-immich-net = {
     serviceConfig.Type = "oneshot";
     requiredBy = with config.virtualisation.oci-containers; [
       "${backend}-immich.service"
@@ -80,15 +89,10 @@ in
       "${backend}-immich-redis.service"
       # "${backend}-immich-ml.service"
     ];
-    before = requiredBy;
+    before = config.systemd.services.create-immich-net.requiredBy;
     script = ''
-      ${lib.getExe pkgs.podman} network exists immich-net || \
+      ${pkgs.podman}/bin/podman network exists immich-net || \
-      ${lib.getExe pkgs.podman} network create immich-net
+      ${pkgs.podman}/bin/podman network create immich-net
     '';
   };
-
-  services.caddy.virtualHosts."photos.cy7.sh".extraConfig = ''
-    import common
-    reverse_proxy localhost:2283
-  '';
 }

hosts/chunk/jellyfin.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  services.jellyfin = {
+    enable = true;
+    dataDir = "/mnt/jellyfin";
+    configDir = "/var/lib/jellyfin/config";
+  };
+}

hosts/chunk/miniflux.nix

@@ -5,14 +5,8 @@
     adminCredentialsFile = config.sops.secrets."miniflux/env".path;
     config = {
       PORT = 8080;
-      BASE_URL = "https://rss.cy7.sh";
+      BASE_URL = "https://rss.cything.io";
       FORCE_REFRESH_INTERVAL = 0; # don't rate limit me
     };
   };
-
-  services.caddy.virtualHosts."rss.cy7.sh".extraConfig = ''
-    import common
-    import authelia
-    reverse_proxy localhost:8080
-  '';
 }

hosts/chunk/rclone.nix

@@ -4,34 +4,6 @@
   lib,
   ...
 }:
-let
-  mkServiceConfig = remote: mount: {
-    Type = "notify";
-    TimeoutSec = "5min 20s";
-    ExecStartPre = "/usr/bin/env mkdir -p ${mount}";
-    ExecStart = ''
-      ${lib.getExe pkgs.rclone} mount \
-        --config ${config.sops.secrets."rclone/config".path} \
-        --allow-other \
-        --cache-dir /var/cache/rclone \
-        --transfers 64 \
-        --vfs-cache-mode full \
-        --vfs-cache-min-free-space 5G \
-        --dir-cache-time 30d \
-        --no-checksum \
-        --no-modtime \
-        --vfs-fast-fingerprint \
-        --vfs-read-chunk-size 8M \
-        --vfs-read-chunk-streams 16 \
-        --sftp-concurrency 128 \
-        --sftp-chunk-size 255k \
-        --buffer-size 0 \
-        --write-back-cache \
-        ${remote} ${mount}
-    '';
-    ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -zu ${mount}";
-  };
-in
 {
   systemd.services.immich-mount = {
     enable = true;
@@ -40,16 +12,31 @@ in
     after = [ "network-online.target" ];
     requiredBy = [ "podman-immich-server.service" ];
     before = [ "podman-immich-server.service" ];
-    serviceConfig = mkServiceConfig "photos:" "/mnt/photos";
+    serviceConfig = {
+      Type = "notify";
+      ExecStartPre = "/usr/bin/env mkdir -p /mnt/photos";
+      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
+        config.sops.secrets."rclone/config".path
+      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --dir-cache-time 72h --vfs-cache-mode writes --vfs-cache-max-size 2G photos: /mnt/photos ";
+      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/photos";
+    };
   };
 
-  systemd.services.garage-mount = {
+  systemd.services.attic-mount = {
     enable = true;
-    description = "Mount the garage data remote";
+    description = "Mount the attic data remote";
     requires = [ "network-online.target" ];
     after = [ "network-online.target" ];
-    requiredBy = [ "garage.service" ];
+    requiredBy = [ "atticd.service" ];
-    before = [ "garage.service" ];
+    before = [ "atticd.service" ];
-    serviceConfig = mkServiceConfig "rsyncnet:garage" "/mnt/garage";
+    serviceConfig = {
+      Type = "notify";
+      ExecStartPre = "/usr/bin/env mkdir -p /mnt/attic";
+      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
+        config.sops.secrets."rclone/config".path
+      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 15G --allow-other rsyncnet:attic /mnt/attic ";
+      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/attic";
     };
+  };
+  programs.fuse.userAllowOther = true;
 }

hosts/chunk/redlib.nix

@@ -10,10 +10,4 @@
       REDLIB_ROBOTS_DISABLE_INDEXING = "on";
     };
   };
-
-  services.caddy.virtualHosts."red.cy7.sh".extraConfig = ''
-    import common
-    import authelia
-    reverse_proxy localhost:8087
-  '';
 }

hosts/chunk/tailscale.nix

@@ -1,16 +0,0 @@
-{ config, ... }:
-{
-  services.tailscale = {
-    enable = true;
-    authKeyFile = config.sops.secrets."tailscale/auth".path;
-    extraUpFlags = [
-      "--advertise-exit-node"
-      "--accept-dns=false"
-    ];
-    extraDaemonFlags = [
-      "--no-logs-no-support"
-    ];
-    useRoutingFeatures = "server";
-    openFirewall = true;
-  };
-}

hosts/chunk/tor.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  services.tor = {
+    enable = true;
+    openFirewall = true;
+    relay = {
+      enable = true;
+      role = "relay";
+    };
+    settings = {
+      ORPort = 9001;
+      Nickname = "chunk";
+      MaxAdvertisedBandwidth = "20MBytes";
+    };
+  };
+}

hosts/chunk/vaultwarden.nix

@@ -1,9 +1,13 @@
-{ ... }:
+{ config, ... }:
 {
-  my.vaultwarden.enable = true;
+  services.vaultwarden = {
-
+    enable = true;
-  services.caddy.virtualHosts."pass.cy7.sh".extraConfig = ''
+    dbBackend = "postgresql";
-    import common
+    environmentFile = config.sops.secrets."vaultwarden/env".path;
-    reverse_proxy localhost:8081
+    config = {
-  '';
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = "8081";
+      DATABASE_URL = "postgresql://vaultwarden:vaultwarden@127.0.0.1:5432/vaultwarden";
+    };
+  };
 }

hosts/common.nix

@@ -1,26 +1,13 @@
-{ inputs, config, pkgs, ... }:
+{ ... }:
 {
   nix = {
-    package = pkgs.lix;
     settings = {
       experimental-features = "nix-command flakes";
       auto-optimise-store = true;
       flake-registry = "";
-      trusted-users = [
+      trusted-users = [ "root" "@wheel" ];
-        "root"
+      trusted-public-keys = [ "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg=" ];
-        "@wheel"
+      substituters = [ "https://cache.cything.io/central" ];
-      ];
-      extra-trusted-public-keys = [
-        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
-      ];
-      extra-substituters = [
-        "https://nix-community.cachix.org"
-        "https://nixcache.cy7.sh"
-      ];
-      secret-key-files = [
-        config.sops.secrets.cache-priv-key.path
-      ];
     };
     channel.enable = false;
     optimise = {
@@ -33,56 +20,25 @@
       persistent = true;
       options = "--delete-older-than 14d";
     };
-    registry.nixpkgs.flake = inputs.nixpkgs;
+    extraOptions = ''
-  };
+	    builders-use-substitutes = true
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  time.timeZone = "America/New_York";
-  networking = {
-    firewall.logRefusedConnections = false;
-    nameservers = [
-      # quad9 (unfiltered)
-      "2620:fe::10"
-      "2620:fe::fe:10"
-      "9.9.9.10"
-      "149.112.112.110"
-    ];
-    timeServers = [
-      # https://github.com/jauderho/nts-servers
-      "ntp3.fau.de"
-      "ntppool1.time.nl"
-      "ntpmon.dcs1.biz"
-      "stratum1.time.cifelli.xyz"
-      "nts.teambelgium.net"
-      "c.st1.ntp.br"
-    ];
-  };
-  services.chrony = {
-    enable = true;
-    enableNTS = true;
-    enableMemoryLocking = true;
-    extraConfig = ''
-      # Expedited Forwarding
-      dscp 46
-      # disable command port
-      cmdport 0
-      # only allow NTS
-      authselectmode require
-      # update the clock only when at least 3 sources agree on the correct time
-      minsources 3
 	  '';
   };
+  time.timeZone = "America/Toronto";
+  networking.firewall.logRefusedConnections = false;
+  networking.nameservers = [
+    # quad9
+    "2620:fe::fe"
+    "2620:fe::9"
+    "9.9.9.9"
+    "149.112.112.112"
+  ];
+
+  # this is true by default and mutually exclusive with
+  # programs.nix-index
+  programs.command-not-found.enable = false;
+  programs.nix-index.enable = false; # set above to false to use this
 
   # see journald.conf(5)
   services.journald.extraConfig = "MaxRetentionSec=2d";
-
-  services.thermald.enable = true;
-  environment.enableAllTerminfo = true;
-
-  sops.secrets.cache-priv-key = {
-    format = "binary";
-    sopsFile = ../secrets/cache-priv-key.pem;
-    mode = "0440";
-    group = "users";
-  };
 }

hosts/titan/Caddyfile

@@ -0,0 +1,37 @@
+{
+  acme_ca https://acme.zerossl.com/v2/DV90
+  acme_eab {
+    key_id {$EAB_KEY_ID}
+    mac_key {$EAB_MAC_KEY}
+  }
+}
+
+(common) {
+  encode zstd gzip
+  header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+}
+
+cything.io {
+  import common
+  reverse_proxy localhost:8084
+
+  header /.well-known/matrix/* Content-Type application/json
+  header /.well-known/matrix/* Access-Control-Allow-Origin *
+  respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
+  respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
+}
+
+www.cything.io {
+  import common
+  redir https://cything.io{uri} permanent
+}
+
+ntfy.cything.io {
+  import common
+  reverse_proxy localhost:8083
+}
+
+status.cything.io {
+  import common
+  reverse_proxy localhost:3001
+}

hosts/titan/backup.nix

@@ -0,0 +1,13 @@
+{
+  config,
+  ...
+}:
+{
+  my.backup = {
+    enable = true;
+    jobName = "titanRsync";
+    repo = "titan";
+    passFile = config.sops.secrets."borg/rsyncnet".path;
+    sshKeyFile = config.sops.secrets."rsyncnet/id_ed25519".path;
+  };
+}

hosts/titan/default.nix

@@ -0,0 +1,98 @@
+{
+  modulesPath,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+    ../common.nix
+    ./disk-config.nix
+    ./hardware-configuration.nix
+    ./ghost.nix
+    ./ntfy.nix
+    ./uptime-kuma.nix
+    ./backup.nix
+  ];
+
+  sops.age.keyFile = "/root/.config/sops/age/keys.txt";
+  sops.secrets = {
+    "caddy/env" = {
+      sopsFile = ../../secrets/services/caddy.yaml;
+    };
+    "services/ntfy" = {
+      sopsFile = ../../secrets/services/ntfy.yaml;
+    };
+    "borg/rsyncnet" = {
+      sopsFile = ../../secrets/borg/titan.yaml;
+    };
+    "rsyncnet/id_ed25519" = {
+      sopsFile = ../../secrets/zh5061/titan.yaml;
+    };
+  };
+
+  boot = {
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+    tmp.cleanOnBoot = true;
+    kernelPackages = pkgs.linuxPackages_latest;
+  };
+
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
+  ];
+
+  system.stateVersion = "24.05";
+
+  environment.systemPackages = with pkgs; [
+    curl
+    git
+  ];
+
+  # network stuff
+  networking.hostName = "titan";
+  networking.networkmanager.enable = true;
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      22
+      80
+      443
+    ];
+    allowedUDPPorts = [
+      443
+    ];
+  };
+
+  # container stuff
+  virtualisation.containers.enable = true;
+  virtualisation.podman = {
+    enable = true;
+    # create 'docker' alias for podman, to use as
+    # drop-in replacement
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      dns_enabled = true;
+      ipv6_enabled = true;
+    };
+  };
+  virtualisation.oci-containers.backend = "podman";
+
+  services.caddy = {
+    enable = true;
+    configFile = ./Caddyfile;
+    environmentFile = config.sops.secrets."caddy/env".path;
+    logFormat = lib.mkForce "level INFO";
+  };
+}

hosts/titan/disk-config.nix

@@ -0,0 +1,33 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        device = "/dev/sda";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/titan/ghost.nix

@@ -0,0 +1,52 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  virtualisation.oci-containers.containers.ghost = {
+    image = "ghost:5-alpine";
+    autoStart = true;
+    ports = [ "127.0.0.1:8084:2368" ];
+    pull = "newer";
+    environment = {
+      database__client = "mysql";
+      database__connection__host = "ghost-db";
+      database__connection__user = "root";
+      database__connection__password = "example";
+      database__connection__database = "ghost";
+      url = "https://cything.io";
+      NODE_ENV = "production";
+    };
+    volumes = [
+      "/opt/ghost/data:/var/lib/ghost/content"
+    ];
+    networks = [ "ghost-net" ];
+    dependsOn = [ "ghost-db" ];
+  };
+
+  virtualisation.oci-containers.containers.ghost-db = {
+    image = "mysql:8.0";
+    autoStart = true;
+    pull = "newer";
+    environment = {
+      MYSQL_ROOT_PASSWORD = "example";
+    };
+    volumes = [
+      "/opt/ghost/db:/var/lib/mysql"
+    ];
+    networks = [ "ghost-net" ];
+  };
+
+  systemd.services.create-ghost-net = {
+    serviceConfig.Type = "oneshot";
+    wantedBy = with config.virtualisation.oci-containers; [
+      "${backend}-ghost.service"
+      "${backend}-ghost-db.service"
+    ];
+    script = ''
+      ${pkgs.podman}/bin/podman network exists ghost-net || \
+      ${pkgs.podman}/bin/podman network create ghost-net
+    '';
+  };
+}

hosts/titan/hardware-configuration.nix

@@ -0,0 +1,26 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  lib,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  boot.initrd.availableKernelModules = [ "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  virtualisation.hypervGuest.enable = true;
+}

hosts/titan/ntfy.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      listen-http = "127.0.0.1:8083";
+      base-url = "https://ntfy.cything.io";
+      upstream-base-url = "https://ntfy.sh";
+      auth-default-access = "deny-all";
+      behind-proxy = true;
+    };
+  };
+}

hosts/titan/uptime-kuma.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  # data stored at /var/lib/uptime-kuma/ but does not expose
+  # an option to change it
+  services.uptime-kuma = {
+    enable = true;
+    settings.PORT = "3001";
+  };
+}

hosts/ytnix/containers.nix

@@ -1,38 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-  virtualisation.oci-containers.containers = {
-    immich-ml =
-      let
-        modelCache = "/opt/immich-ml";
-      in
-      {
-        image = "ghcr.io/immich-app/immich-machine-learning:release";
-        autoStart = true;
-        pull = "newer";
-        ports = [ "3003:3003" ];
-        environment = {
-          REDIS_HOSTNAME = "immich-redis";
-          DB_HOSTNAME = "immich-db";
-        };
-        volumes = [ "${modelCache}:/cache" ];
-        networks = [ "immich-net" ];
-      };
-  };
-
-  systemd.services.create-immich-net = rec {
-    serviceConfig.Type = "oneshot";
-    requiredBy = with config.virtualisation.oci-containers; [
-      "${backend}-immich-ml.service"
-    ];
-    before = requiredBy;
-    script = ''
-      ${lib.getExe pkgs.podman} network exists immich-net || \
-      ${lib.getExe pkgs.podman} network create immich-net
-    '';
-  };
-}

hosts/ytnix/default.nix

@@ -1,6 +1,7 @@
 {
   config,
   pkgs,
+  inputs,
   lib,
   ...
 }:
@@ -9,8 +10,12 @@
     ./hardware-configuration.nix
     ../common.nix
     ../zsh.nix
-    ./tailscale.nix
+    {
-    ./containers.nix
+      disabledModules = [
+        "services/backup/btrbk.nix"
+      ];
+    }
+    (inputs.nixpkgs-btrbk + "/nixos/modules/services/backup/btrbk.nix")
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -18,33 +23,32 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/yt.yaml;
     };
+    "services/ntfy" = {
+      sopsFile = ../../secrets/services/ntfy.yaml;
+    };
+    "wireguard/private" = {
+      sopsFile = ../../secrets/wireguard/yt.yaml;
+    };
+    "wireguard/psk" = {
+      sopsFile = ../../secrets/wireguard/yt.yaml;
+    };
     "rsyncnet/id_ed25519" = {
       sopsFile = ../../secrets/zh5061/yt.yaml;
     };
-    "tailscale/auth" = {
+    "newsboat/miniflux" = {
-      sopsFile = ../../secrets/services/tailscale.yaml;
+      sopsFile = ../../secrets/newsboat.yaml;
-    };
-    "aws/key_id" = {
-      sopsFile = ../../secrets/yt/aws.yaml;
       owner = "yt";
     };
-    "aws/key_secret" = {
-      sopsFile = ../../secrets/yt/aws.yaml;
-      owner = "yt";
-    };
-    "vaultwarden/env" = {
-      sopsFile = ../../secrets/services/vaultwarden.yaml;
-    };
   };
 
   boot = {
     loader = {
       # lanzaboote replaces systemd-boot
       systemd-boot.enable = lib.mkForce false;
-      efi.canTouchEfiVariables = true;
+      efi.canTouchEfiVariables = false; # toggle when installing
     };
     tmp.cleanOnBoot = true;
-    kernelPackages = pkgs.linuxKernel.packages.linux_zen;
+    kernelPackages = pkgs.linuxPackages_latest;
     extraModulePackages = with config.boot.kernelPackages; [
       rtl8821ce
     ];
@@ -61,7 +65,6 @@
       pkiBundle = "/var/lib/sbctl";
     };
     kernel.sysctl."kernel.sysrq" = 1;
-    binfmt.emulatedSystems = [ "aarch64-linux" ];
   };
 
   networking = {
@@ -79,25 +82,15 @@
     networkmanager = {
       enable = true;
       dns = "none";
-      wifi = {
+      wifi.backend = "iwd";
-        backend = "iwd";
-        powersave = false;
-      };
     };
     resolvconf.enable = true;
     firewall = {
-      enable = true;
+      allowedUDPPorts = [ 51820 ]; # for wireguard
-      trustedInterfaces = [ "tailscale0" ];
+      trustedInterfaces = [ "wg0" ];
-      # allowedTCPPorts = [
-      #   8080 # mitmproxy
-      #   22000 # syncthing
-      #   3003 # immich-ml
-      # ];
-    };
-    hosts = {
-      "100.122.132.30" = [ "s3.cy7.sh" ];
     };
   };
+  programs.nm-applet.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {
@@ -106,7 +99,9 @@
     alsa.enable = true;
     alsa.support32Bit = true;
     wireplumber.extraConfig.bluetoothEnhancements = {
-      # https://julian.pages.freedesktop.org/wireplumber/daemon/configuration/bluetooth.html#bluetooth-configuration
+      "wireplumber.settings" = {
+        "bluetooth.autoswitch-to-headset-profile" = false;
+      };
       "monitor.bluez.properties" = {
         "bluez5.enable-sbc-xq" = true;
         "bluez5.enable-msbc" = true;
@@ -114,10 +109,6 @@
         "bluez5.roles" = [
           "a2dp_sink"
           "a2dp_source"
-          "hsp_hs"
-          "hsp_ag"
-          "hfp_hf"
-          "hfp_ag"
         ];
       };
     };
@@ -144,53 +135,38 @@
     "wheel"
     "libvirtd"
     "docker"
-    "disk"
-    "adbusers"
-    "podman"
   ];
 
-  environment.systemPackages =
+  environment.systemPackages = with pkgs; [
-    with pkgs;
-    lib.flatten [
     tmux
     vim
     wget
+    neovim
+    git
+    python3
+    wl-clipboard
+    mako
     tree
     kitty
     borgbackup
+    brightnessctl
+    alsa-utils
+    nixd
+    bluetuith
+    libimobiledevice
+    pass-wayland
     htop
     file
     dnsutils
-      q
     age
     compsize
     wireguard-tools
     traceroute
     sops
+    restic
+    haskell-language-server
+    ghc
     sbctl # secure boot
-      lm_sensors
-      sshfs
-      openssl
-      just
-      killall
-      lshw
-      bubblewrap
-      fuse-overlayfs
-      dwarfs
-      wineWowPackages.stagingFull
-      (with gst_all_1; [
-        gst-plugins-good
-        gst-plugins-bad
-        gst-plugins-ugly
-        gst-plugins-base
-      ])
-      vulkan-loader
-      (heroic.override {
-        extraPkgs = pkgs: [
-          pkgs.gamescope
-          pkgs.gamemode
-        ];
-      })
   ];
 
   environment.sessionVariables = {
@@ -204,27 +180,25 @@
   services.displayManager = {
     enable = true;
     autoLogin.user = "yt";
-    defaultSession = "plasma";
-    sddm = {
-      enable = true;
-      wayland.enable = true;
-      autoNumlock = true;
-    };
   };
 
-  fonts = {
+  fonts.packages = with pkgs; [
-    packages = with pkgs; [
     nerd-fonts.roboto-mono
     ibm-plex
   ];
-    enableDefaultPackages = true;
+  fonts.enableDefaultPackages = true;
-  };
 
   hardware.enableAllFirmware = true;
   hardware.bluetooth = {
     enable = true;
     powerOnBoot = true;
   };
+  services.blueman.enable = true;
+
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
 
   my.backup = {
     enable = true;
@@ -236,119 +210,82 @@
       "/home/yt/.local/share/Steam"
       "**/.wine"
       "/home/yt/Games"
-      "/home/yt/Videos"
-      "/home/yt/.bitmonero"
     ];
     repo = "yt";
     passFile = config.sops.secrets."borg/rsyncnet".path;
     sshKeyFile = config.sops.secrets."rsyncnet/id_ed25519".path;
   };
 
+  services.btrbk.instances.local = {
+    onCalendar = "hourly";
+    # only create snapshots automatically. backups are triggered manually with `btrbk resume`
+    snapshotOnly = true;
+    settings = {
+      snapshot_preserve_min = "latest";
+      target_preserve = "*d";
+      target_preserve_min = "no";
+      target = "/mnt/external/btr_backup/ytnix";
+      stream_compress = "zstd";
+      stream_compress_level = "8";
+      snapshot_dir = "/snapshots";
+      subvolume = {
+        "/home" = { };
+        "/" = { };
+      };
+    };
+  };
+
   programs.steam = {
     enable = true;
     extest.enable = true;
     extraCompatPackages = with pkgs; [ proton-ge-bin ];
   };
-  programs.gamescope.enable = true;
+  hardware.steam-hardware.enable = true;
 
   services.logind = {
-    lidSwitch = "suspend";
+    lidSwitch = "hibernate";
-    powerKey = "poweroff";
+    powerKey = "hibernate";
-    suspendKey = "hibernate";
   };
 
   xdg.mime.defaultApplications = {
     "application/pdf" = "okular.desktop";
     "image/*" = "gwenview.desktop";
+    "*/html" = "chromium-browser.desktop";
   };
 
-  virtualisation.libvirtd = {
+  programs.thunar = {
     enable = true;
-    qemu.vhostUserPackages = with pkgs; [ virtiofsd ];
+    plugins = with pkgs.xfce; [
-  };
+      thunar-archive-plugin
-  programs.virt-manager.enable = true;
+      thunar-volman
-  my.containerization.enable = true;
-
-  services.usbmuxd.enable = true;
-  programs.nix-ld.dev = {
-    enable = true;
-    # nix run github:thiagokokada/nix-alien#nix-alien-find-libs ./<binary>
-    libraries = with pkgs; [
-      mesa
-      extest
-      stdenv.cc.cc
-      libGL
-      fontconfig
-      libxkbcommon
-      zlib
-      libz
-      libxml2
-      dbus
-      freetype
-      egl-wayland
-      waylandpp
-      cairo
-      xcb-util-cursor
-      libplist
-      p11-kit
-      kdePackages.qtwayland
-      qt6.full
-      qt6.qtwayland
-      qt5.full
-      qt5.qtwayland
-      xorg.libX11
-      xorg.libxcb
-      xorg.xcbutilwm
-      xorg.xcbutilimage
-      xorg.xcbutilkeysyms
-      xorg.xcbutilrenderutil
-      xorg.libXScrnSaver
-      xorg.libXcomposite
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libXtst
-      xorg.libxkbfile
-      xorg.libxshmfence
-      xorg.libXxf86vm
-      xorg.libSM
-      gtk3
-      pango
-      gdk-pixbuf
-      glib
-      libnotify
-      SDL2
-      libpng
-      libjpeg8
-      libtiff
-      curl
-      pcre2
-      gsettings-desktop-schemas
-      fzf
-      systemd
     ];
   };
+  # preference changes don't work in thunar without this
+  programs.xfconf.enable = true;
+  # mount, trash and stuff in thunar
+  services.gvfs.enable = true;
+  # thumbnails in thunar
+  services.tumbler.enable = true;
+
+  virtualisation = {
+    libvirtd.enable = true;
+    docker.enable = true;
+  };
+  programs.virt-manager.enable = true;
+
+  services.usbmuxd.enable = true;
+  programs.nix-ld.enable = true;
   programs.evolution.enable = true;
 
   xdg.portal = {
     enable = true;
     wlr.enable = true;
-    xdgOpenUsePortal = true;
-    extraPortals = with pkgs; [
-      xdg-desktop-portal-gtk
-      xdg-desktop-portal-gnome
-    ];
   };
 
   programs.obs-studio = {
     enable = true;
     plugins = with pkgs.obs-studio-plugins; [
       wlrobs
-      obs-pipewire-audio-capture
     ];
   };
 
@@ -360,37 +297,29 @@
     ];
   };
 
-  services.ollama.enable = false;
+  services.ollama.enable = true;
+
+  # wireguard setup
+  networking.wg-quick.interfaces.wg0 = {
+    autostart = false;
+    address = [
+      "10.0.0.2/24"
+      "fdc9:281f:04d7:9ee9::2/64"
+    ];
+    privateKeyFile = config.sops.secrets."wireguard/private".path;
+    peers = [
+      {
+        publicKey = "a16/F/wP7HQIUtFywebqPSXQAktPsLgsMLH9ZfevMy0=";
+        allowedIPs = [
+          "0.0.0.0/0"
+          "::/0"
+        ];
+        endpoint = "31.59.129.225:51820";
+        persistentKeepalive = 25;
+        presharedKeyFile = config.sops.secrets."wireguard/psk".path;
+      }
+    ];
+  };
 
   services.trezord.enable = true;
-
-  programs.niri.enable = false;
-  programs.niri.package = pkgs.niri-unstable;
-  programs.xwayland.enable = true;
-
-  services.udev.extraHwdb = ''
-    SUBSYSTEM=="usb", SYSFS{idVendor}=="090c", SYSFS{idProduct}=="1000", ACTION=="add", GROUP="users", MODE="0664"
-  '';
-
-  services.desktopManager.plasma6 = {
-    enable = true;
-    enableQt5Integration = true;
-  };
-
-  programs.appimage = {
-    enable = true;
-    binfmt = true;
-  };
-
-  programs.adb.enable = true;
-  services.envfs.enable = true;
-  programs.kdeconnect.enable = true;
-  programs.dconf.enable = true;
-
-  programs.ccache.enable = true;
-  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
-  programs.fuse.userAllowOther = true;
-  nix.settings.sandbox = false;
-
-  programs.ssh.startAgent = true;
 }

hosts/ytnix/tailscale.nix

@@ -1,18 +0,0 @@
-{ config, ... }:
-{
-  services.tailscale = {
-    enable = true;
-    authKeyFile = config.sops.secrets."tailscale/auth".path;
-    openFirewall = true;
-    useRoutingFeatures = "client";
-    extraUpFlags = [
-      "--exit-node=chunk"
-      "--accept-dns=false"
-      "--operator=yt"
-      "--exit-node-allow-lan-access"
-    ];
-    extraDaemonFlags = [
-      "--no-logs-no-support"
-    ];
-  };
-}

justfile

@@ -1,20 +0,0 @@
-update:
-    git branch -D update || true
-    git switch -c update
-    nix flake update --commit-lock-file
-    git push -f
-    git switch main
-
-upgrade:
-    git switch update
-    sudo nixos-rebuild switch -L --flake . --use-substitutes
-    nixos-rebuild switch -L --flake .#chunk --target-host root@2a0f:85c1:840:2bfb::1 --use-substitutes
-    home-manager -L switch --flake .
-    git switch main
-    git merge update
-    git branch -d update
-
-switch:
-    sudo nixos-rebuild switch -L --flake . --use-substitutes
-    nixos-rebuild switch -L --flake .#chunk --target-host root@2a0f:85c1:840:2bfb::1 --use-substitutes
-    home-manager -L switch --flake .

modules/attic.nix

@@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.attic;
-in
-{
-  options.my.attic = {
-    enable = lib.mkEnableOption "attic";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.atticd = {
-      enable = true;
-      environmentFile = config.sops.secrets."attic/env".path;
-      settings = {
-        listen = "[::]:8091";
-        api-endpoint = "https://cache.cy7.sh/";
-        allowed-hosts = [
-          "cache.cy7.sh"
-          "cdn.cy7.sh"
-        ];
-        require-proof-of-possession = false;
-        compression = {
-          type = "none";
-          level = 3;
-        };
-        database.url = "postgresql:///atticd?host=/run/postgresql";
-
-        storage = {
-          type = "s3";
-          region = "us-east-1";
-          bucket = "attic";
-          # attic must be patched to never serve pre-signed s3 urls directly
-          # otherwise it will redirect clients to this localhost endpoint
-          endpoint = "http://127.0.0.1:3900";
-        };
-
-        garbage-collection = {
-          default-retention-period = "1 month";
-        };
-
-        chunking = {
-          # disable chunking since garage does its own
-          nar-size-threshold = 0;
-          # defaults
-          min-size = 16384;
-          avg-size = 65536;
-          max-size = 262144;
-        };
-      };
-    };
-
-    systemd.services.atticd = {
-      requires = [ "garage.service" ];
-      after = [ "garage.service" ];
-      environment = {
-        RUST_LOG = "INFO";
-      };
-    };
-
-    services.caddy.virtualHosts."cache.cy7.sh" = {
-      serverAliases = [ "cdn.cy7.sh" ];
-      extraConfig = ''
-        import common
-        reverse_proxy localhost:8091
-      '';
-    };
-  };
-}

modules/authelia.nix

@@ -1,137 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.authelia;
-  getSecret = path: config.sops.secrets.${path}.path;
-  sopsConfig = {
-    sopsFile = ../secrets/services/authelia.yaml;
-    owner = "authelia-main";
-  };
-  domain = "auth.cy7.sh";
-  varPath = "/var/lib/authelia-main";
-in
-{
-  options.my.authelia = {
-    enable = lib.mkEnableOption "authelia";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.authelia.instances.main = {
-      enable = true;
-      settings = {
-        theme = "dark";
-        default_2fa_method = "webauthn";
-        log.level = "info";
-        log.format = "text";
-        server = {
-          disable_healthcheck = true;
-          endpoints.authz.forward-auth.implementation = "ForwardAuth";
-        };
-        authentication_backend.file.path = "${varPath}/users_database.yaml";
-        access_control = {
-          default_policy = "deny";
-          rules = [
-            {
-              domain = "*.cy7.sh";
-              policy = "one_factor";
-            }
-          ];
-        };
-        session.cookies = [{
-          domain = "cy7.sh";
-          authelia_url = "https://${domain}";
-        }];
-        storage.local.path = "${varPath}/db.sqlite3";
-        notifier.filesystem.filename = "${varPath}/notifications.txt";
-        webauthn = {
-          enable_passkey_login = true;
-        };
-        identity_providers.oidc.claims_policies = {
-          # https://github.com/karakeep-app/karakeep/issues/410
-          # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
-          karakeep.id_token = [ "email" ];
-        };
-        identity_providers.oidc.clients = [
-          {
-            client_id = "4EIrpRb9rnwHWjYWvlz2gYrtTmoOLF1D5gqXw28BvmOS0f-9T2p4CFwuctf4Co1hkpo2sd4Y";
-            client_name = "immich";
-            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$Vny2G8EbSPafSwnIuq2Zkg$eF2om4WDEaqCFmrAG27h2mYl+cXxXyttPJ7gaPLs+f8";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [
-              "https://photos.cy7.sh/auth/login"
-              "https://photos.cy7.sh/user-settings"
-              "app.immich:///oauth-callback"
-            ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-          }
-          {
-            client_id = "_kuUEYxyfXjInJCniwugpw2Qn6iI-YW24NOkHZG~63BAhnAACDZ.xsLqOdGghj2DNZxXR0sU";
-            client_name = "Forgejo";
-            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$O2O5r/7A8hc4EMvernQ4Dw$YOVqtwY3jv0HlcxmviPq2CRnD7Dw85V9KDtTSUQE7bA";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [
-              "https://git.cy7.sh/user/oauth2/authelia/callback"
-            ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-            token_endpoint_auth_method = "client_secret_basic";
-          }
-          {
-            client_id = "b_ITCG0uNzy9lZ5nVC~Ny5R35te8I3hoQW1uraCbdxeiE9VuiCIelMmZZ7dAZLg_anTUWSQG";
-            client_name = "HedgeDoc";
-            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$MFSXW3gjIZf0M3e8s8RJCg$6KWwksJe2vdUebPEdYc0Zy88fzGcHPrbStcqkiXl+Hg";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [
-              "https://pad.cy7.sh/auth/oauth2/callback"
-            ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-            grant_types = [ "refresh_token" "authorization_code" ];
-            response_types = [ "code" ];
-            response_modes = [ "form_post" "query" "fragment" ];
-            audience = [];
-            token_endpoint_auth_method = "client_secret_post";
-          }
-          {
-            client_id = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
-            client_name = "Karakeep";
-            client_secret = "$pbkdf2-sha512$310000$4UanDZq.6oholJW3CmKwtQ$9e3hqR8qGU4LoneR/Y9jtJTx0iSzATI4iXymrs8QrmGw4JY1BPF4.IJ9Jbc.8cikU4qpfUIFO6r2dG7JHznCnw";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [ "https://keep.cy7.sh/api/auth/callback/custom" ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-            claims_policy = "karakeep";
-          }
-        ];
-      };
-      secrets = {
-        sessionSecretFile = getSecret "authelia/session";
-        storageEncryptionKeyFile = getSecret "authelia/storage";
-        jwtSecretFile = getSecret "authelia/jwt";
-        oidcHmacSecretFile = getSecret "authelia/hmac";
-        oidcIssuerPrivateKeyFile = getSecret "authelia/oidc_private";
-      };
-    };
-
-    sops.secrets = {
-      "authelia/jwt" = sopsConfig;
-      "authelia/storage" = sopsConfig;
-      "authelia/session" = sopsConfig;
-      "authelia/hmac" = sopsConfig;
-      "authelia/oidc_private" = sopsConfig;
-    };
-
-    services.caddy.virtualHosts.${domain}.extraConfig = ''
-      import common
-      reverse_proxy localhost:9091
-    '';
-  };
-}

modules/backup.nix

@@ -2,10 +2,12 @@
   config,
   lib,
   pkgs,
+  inputs,
   ...
 }:
 let
   cfg = config.my.backup;
+  hostname = config.networking.hostName;
   defaultPaths = [
     "/root"
     "/home"
@@ -29,6 +31,13 @@ let
   ];
 in
 {
+  imports = [
+    {
+      disabledModules = [ "services/backup/borgbackup.nix" ];
+    }
+    (inputs.nixpkgs-borg + "/nixos/modules/services/backup/borgbackup.nix")
+  ];
+
   options.my.backup = {
     enable = lib.mkEnableOption "backup";
     paths = lib.mkOption {
@@ -96,6 +105,23 @@ in
       ];
       # warnings are often not that serious
       failOnWarnings = false;
+      postHook = ''
+        invocationId=$(systemctl show -p InvocationID --value borgbackup-job-${cfg.jobName}.service)
+        title="${hostname}: backup completed with exit code: $exitStatus"
+        msg=$(journalctl -o cat _SYSTEMD_INVOCATION_ID=$invocationId)
+
+        if [ "$exitStatus" -eq 0 ]; then
+          tag="v"
+        else
+          tag="rotating_light"
+        fi
+
+        ${pkgs.curl}/bin/curl -sL -u $(cat ${config.sops.secrets."services/ntfy".path}) \
+        -H "Title: $title" \
+        -H "Tags: $tag" \
+        -d "$msg" \
+        https://ntfy.cything.io/backups > /dev/null
+      '';
 
       prune.keep = {
         within = "2d";

modules/caddy.nix

@@ -1,58 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.my.caddy;
-in
-{
-  options.my.caddy = {
-    enable = lib.mkEnableOption "caddy reverse proxy";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.caddy = {
-      enable = true;
-      package = pkgs.caddy.withPlugins {
-        plugins = [
-          # error message will tell you the correct version tag to use
-          # (still need the @ to pass nix config check)
-          "github.com/caddy-dns/cloudflare@v0.0.0-20250228175314-1fb64108d4de"
-        ];
-        hash = "sha256-pfh9DXUj35jlAntkWc4D5wuW04xxQfM1rZ4KFauMzvc=";
-      };
-      logFormat = lib.mkForce "level INFO";
-      acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
-      extraConfig = ''
-        (common) {
-          encode zstd gzip
-          header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
-          tls {
-            dns cloudflare {$CLOUDFLARE_KEY}
-            resolvers 1.1.1.1 8.8.8.8
-          }
-        }
-
-        (authelia) {
-          forward_auth localhost:9091 {
-		        uri /api/authz/forward-auth
-		        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
-	        }
-        }
-      '';
-      environmentFile = config.sops.secrets."caddy/env".path;
-      
-      virtualHosts."keys.cy7.sh".extraConfig = ''
-        import common
-        respond / 200 {
-          body "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhUt9h5dCcrwOrZNKkStCX5OxumPzEwYXSU/0DgtWgP
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD
-        sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
-        }
-      '';
-    };
-  };
-}

modules/containerization.nix

@@ -1,42 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.containerization;
-in
-{
-  options.my.containerization = {
-    enable = lib.mkEnableOption "containerization";
-    usePodman = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "whether to use podman instead of docker";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation = {
-      containers.enable = true;
-      podman = lib.mkIf cfg.usePodman {
-        enable = true;
-        # create 'docker' alias for podman, to use as
-        # drop-in replacement
-        dockerCompat = true;
-        defaultNetwork.settings = {
-          dns_enabled = true;
-          ipv6_enabled = true;
-        };
-        # answer on /var/run/docker.sock
-        dockerSocket.enable = true;
-        autoPrune = {
-          enable = true;
-          dates = "daily";
-        };
-      };
-      docker.enable = lib.mkIf (!cfg.usePodman) true;
-      oci-containers.backend = lib.mkIf (!cfg.usePodman) "docker";
-    };
-  };
-}

modules/default.nix

@@ -2,14 +2,5 @@
 {
   imports = [
     ./backup.nix
-    ./caddy.nix
-    ./roundcube.nix
-    ./zipline.nix
-    ./containerization.nix
-    ./vaultwarden.nix
-    ./searx.nix
-    ./attic.nix
-    ./authelia.nix
-    ./karakeep.nix
   ];
 }

modules/karakeep.nix

@@ -1,81 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.karakeep;
-in
-{
-  options.my.karakeep = {
-    enable = lib.mkEnableOption "karakeep";
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-    };
-    port = lib.mkOption {
-      default = 3002;
-      description = "port for the web service";
-      type = lib.types.port;
-    };
-    domain = lib.mkOption {
-      default = "keep.cy7.sh";
-      type = lib.types.str;
-    };
-    environmentFile = lib.mkOption {
-      default = config.sops.secrets."karakeep/env".path;
-      type = lib.types.path;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation.oci-containers.containers = {
-      karakeep-web = {
-        image = "ghcr.io/karakeep-app/karakeep:release";
-        pull = "newer";
-        volumes = [ "${cfg.dataDir}:/data" ];
-        ports = [ "${toString cfg.port}:3000"];
-        dependsOn = [
-          "karakeep-chrome"
-          "karakeep-meilisearch"
-        ];
-        environment = {
-          MEILI_ADDR = "http://karakeep-meilisearch:7700";
-          BROWSER_WEB_URL = "http://karakeep-chrome:9222";
-          DATA_DIR =  "/data";
-          NEXTAUTH_URL = "https://${cfg.domain}";
-          DISABLE_PASSWORD_AUTH = "true";
-          OAUTH_WELLKNOWN_URL = "https://auth.cy7.sh/.well-known/openid-configuration";
-          OAUTH_CLIENT_ID = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
-          OAUTH_PROVIDER_NAME = "Authelia";
-          OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING = "true";
-        };
-        # needs NEXTAUTH_SECRET
-        environmentFiles = [ "${cfg.environmentFile}" ];
-      };
-
-      karakeep-chrome = {
-        image = "ghcr.io/zenika/alpine-chrome:latest";
-        pull = "newer";
-        cmd = [
-          "--no-sandbox"
-          "--disable-gpu"
-          "--disable-dev-shm-usage"
-          "--remote-debugging-address=0.0.0.0"
-          "--remote-debugging-port=9222"
-          "--hide-scrollbars"
-        ];
-      };
-
-      karakeep-meilisearch = {
-        image = "getmeili/meilisearch:latest";
-        volumes = [ "meilisearch:/meili_data" ];
-        environment = {
-          MEILI_NO_ANALYTICS = "true";
-        };
-        # needs MEILI_MASTER_KEY
-        environmentFiles = [ "${cfg.environmentFile}" ];
-      };
-    };
-
-    services.caddy.virtualHosts.${cfg.domain}.extraConfig = ''
-      import common
-      reverse_proxy localhost:${toString cfg.port}
-    '';
-  };
-}

modules/roundcube.nix

@@ -1,56 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.my.roundcube;
-  fpm = config.services.phpfpm.pools.roundcube;
-  roundcube = config.services.roundcube;
-in
-{
-  options.my.roundcube = {
-    enable = lib.mkEnableOption "roundcube webmail";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.roundcube = {
-      enable = true;
-      configureNginx = false;
-      package = pkgs.roundcube.withPlugins (
-        p: with p; [
-          persistent_login
-          contextmenu
-          custom_from
-          thunderbird_labels
-        ]
-      );
-      plugins = [
-        "persistent_login"
-        "contextmenu"
-        "custom_from"
-        "thunderbird_labels"
-      ];
-      dicts = with pkgs.aspellDicts; [ en ];
-      extraConfig = ''
-        $config['imap_host'] = "ssl://imap.migadu.com:993";
-        $config['smtp_host'] = "ssl://smtp.migadu.com:465";
-        $config['smtp_user'] = "%u";
-        $config['smtp_pass'] = "%p";
-      '';
-    };
-
-    services.phpfpm.pools.roundcube.settings = lib.mapAttrs (name: lib.mkForce) {
-      "listen.owner" = "caddy";
-      "listen.group" = "caddy";
-    };
-
-    services.caddy.virtualHosts."mail.cy7.sh".extraConfig = ''
-      import common
-      root ${roundcube.package}
-      php_fastcgi unix/${fpm.socket}
-      file_server
-    '';
-  };
-}

modules/searx.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.searx;
-in
-{
-  options.my.searx = {
-    enable = lib.mkEnableOption "searx";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.searx = {
-      enable = true;
-      runInUwsgi = true;
-      uwsgiConfig = {
-        disable-logging = true;
-        http = "127.0.0.1:8090";
-      };
-      settings = {
-        # get secret from env
-        server.secret_key = "@SEARX_SECRET_KEY@";
-      };
-      environmentFile = config.sops.secrets."searx/env".path;
-      redisCreateLocally = true; # required for limiter
-      limiterSettings = {
-        real_ip = {
-          x_for = 1;
-          ipv4_prefix = 32;
-          ipv6_prefix = 56;
-        };
-        botdetection.ip_lists.pass_ip = [
-          "100.121.152.86"
-          "100.66.32.54"
-        ];
-        link_token = true;
-      };
-    };
-
-    services.caddy.virtualHosts."x.cy7.sh".extraConfig = ''
-      import common
-      reverse_proxy 127.0.0.1:8090
-    '';
-  };
-}

modules/vault.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.vault;
-in
-{
-  options.my.vault = {
-    enable = lib.mkEnableOption "hashicorp vault";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.vault = {
-
-    };
-  };
-}

modules/vaultwarden.nix

@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.vaultwarden;
-in
-{
-  options.my.vaultwarden = {
-    enable = lib.mkEnableOption "vaultwarden";
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "https://pass.cy7.sh";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.vaultwarden = {
-      enable = true;
-      dbBackend = "postgresql";
-      environmentFile = config.sops.secrets."vaultwarden/env".path;
-      config = {
-        ROCKET_ADDRESS = "0.0.0.0";
-        ROCKET_PORT = "8081";
-        DATABASE_URL = "postgresql://vaultwarden:vaultwarden@127.0.0.1:5432/vaultwarden";
-        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,ssh-agent,ssh-key-vault-item,autofill-v2";
-        DOMAIN = cfg.domain;
-      };
-    };
-  };
-}

modules/zipline.nix

@@ -1,33 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.zipline;
-in
-{
-  options.my.zipline = {
-    enable = lib.mkEnableOption "zipline";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.zipline = {
-      enable = true;
-      settings = {
-        CORE_HOSTNAME = "127.0.0.1";
-        CORE_PORT = 3001;
-        DATASOURCE_TYPE = "s3";
-        DATASOURCE_S3_ENDPOINT = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
-        DATASOURCE_S3_BUCKET = "zipline";
-        DATASOURCE_S3_REGION = "auto";
-      };
-      environmentFiles = [ config.sops.secrets."zipline/env".path ];
-    };
-
-    services.caddy.virtualHosts."host.cy7.sh".extraConfig = ''
-      import common
-      reverse_proxy 127.0.0.1:3001
-    '';
-  };
-}

overlay/attic/default.nix

@@ -0,0 +1,23 @@
+final: prev: {
+  attic-client = prev.attic-client.override (old: {
+    rustPlatform = old.rustPlatform // {
+      buildRustPackage =
+        args:
+        old.rustPlatform.buildRustPackage (
+          args
+          // {
+            version = "0.1.1";
+            src = final.fetchFromGitHub {
+              owner = "cything";
+              repo = "attic";
+              rev = "d660c85bdb6bb10499a23a846a13107ea0c72769";
+              hash = "sha256-E22d2OLV02L2QdiSeK58flveehR8z8WIKkcN/njAMdg=";
+            };
+            cargoLock = null;
+            cargoHash = "sha256-AbpWnYfBMrR6oOfy2LkQvIPYsClCWE89bJav+iHTtLM=";
+            useFetchCargoVendor = true;
+          }
+        );
+    };
+  });
+}

overlay/conduwuit/default.nix

@@ -0,0 +1,39 @@
+final: prev: {
+  conduwuit = prev.conduwuit.override (old: {
+    rustPlatform = old.rustPlatform // {
+      buildRustPackage =
+        args:
+        old.rustPlatform.buildRustPackage (
+          args
+          // {
+            version = "0.5.0-rc2";
+            src = final.fetchFromGitHub {
+              owner = "girlbossceo";
+              repo = "conduwuit";
+              rev = "8c74e35e7640a041c1f3496d82585e5240294352";
+              hash = "sha256-/2YD3TXT9pQ7oPEm9wDrq35afU88qukMIWqrBX5JyXg=";
+            };
+            doCheck = false;
+            cargoHash = "sha256-ZenMTCEJrALKQnW7/eXqrhFj+BedE9i/rQZMsPHl8K0=";
+            cargoPatches = [
+              ./fix-lint.patch
+            ];
+            # unstable has this set to "conduit"
+            meta.mainProgram = "conduwuit";
+
+            buildFeatures = [
+              "brotli_compression"
+              "element_hacks"
+              "gzip_compression"
+              "release_max_log_level" # without this feature to enable debug logging
+              "sentry_telemetry"
+              "systemd"
+              "zstd_compression"
+              "jemalloc"
+              "io_uring"
+            ];
+          }
+        );
+    };
+  });
+}

overlay/conduwuit/fix-lint.patch

@@ -0,0 +1,74 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 3f900a114..0d30a3fec 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -4493,7 +4493,7 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+ [[package]]
+ name = "tracing"
+ version = "0.1.41"
+-source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
+ dependencies = [
+  "log",
+  "pin-project-lite",
+@@ -4504,7 +4504,7 @@ dependencies = [
+ [[package]]
+ name = "tracing-attributes"
+ version = "0.1.28"
+-source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -4514,7 +4514,7 @@ dependencies = [
+ [[package]]
+ name = "tracing-core"
+ version = "0.1.33"
+-source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
+ dependencies = [
+  "once_cell",
+  "valuable",
+@@ -4534,7 +4534,7 @@ dependencies = [
+ [[package]]
+ name = "tracing-log"
+ version = "0.2.0"
+-source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
+ dependencies = [
+  "log",
+  "once_cell",
+@@ -4562,7 +4562,7 @@ dependencies = [
+ [[package]]
+ name = "tracing-subscriber"
+ version = "0.3.18"
+-source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
+ dependencies = [
+  "matchers",
+  "nu-ansi-term",
+diff --git a/Cargo.toml b/Cargo.toml
+index 76acda807..a2916a6aa 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -513,16 +513,16 @@ version = "0.2"
+ # https://github.com/girlbossceo/tracing/commit/b348dca742af641c47bc390261f60711c2af573c
+ [patch.crates-io.tracing-subscriber]
+ git = "https://github.com/girlbossceo/tracing"
+-rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++rev = "3cf1c991e3660785d3855a34245949557db33209"
+ [patch.crates-io.tracing]
+ git = "https://github.com/girlbossceo/tracing"
+-rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++rev = "3cf1c991e3660785d3855a34245949557db33209"
+ [patch.crates-io.tracing-core]
+ git = "https://github.com/girlbossceo/tracing"
+-rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++rev = "3cf1c991e3660785d3855a34245949557db33209"
+ [patch.crates-io.tracing-log]
+ git = "https://github.com/girlbossceo/tracing"
+-rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
++rev = "3cf1c991e3660785d3855a34245949557db33209"
+ 
+ # adds a tab completion callback: https://github.com/girlbossceo/rustyline-async/commit/de26100b0db03e419a3d8e1dd26895d170d1fe50
+ # adds event for CTRL+\: https://github.com/girlbossceo/rustyline-async/commit/67d8c49aeac03a5ef4e818f663eaa94dd7bf339b

overlay/default.nix

@@ -1,18 +1,8 @@
-{ inputs }:
+let
-[
+  overlays = [
-  (
+    ./conduwuit
-    final: prev:
+    ./attic
-    let
+  ];
-      nixpkgsFrom = flake: pkg: flake.legacyPackages.${prev.system}.${pkg};
+  importedOverlays = map (m: import m) overlays;
-      pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
+in
-    in
+  importedOverlays
-    {
-      garage = (
-        (pkgFrom inputs.garage "default").overrideAttrs {
-          meta.mainProgram = "garage";
-        }
-      );
-      nil = pkgFrom inputs.nil "default";
-    }
-  )
-]

secrets/cache-priv-key.pem

@@ -1,28 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:IVRg3IqrlV1Cy3xwyVszhUnRzbWP3OSb/XZF1H0N30eKL8d0DxFGngC5qMgRcmSs203/QL3w0fENp1u0f8tVajqJVlzLjlsiQrMdtXmiMv0LKO7E+aj4UZ0wMchB0XgSVUWrKUXxZrA=,iv:3GtA07yuAAI++RsLSwY3U62k1iG9+hvkGn45HjFt/Gk=,tag:PJ13CrjcE06KMC383txqHw==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLcGd1alJmNWM3dVBmSWxs\nRHBTOVV6U3p1U3Q3bzQ3OXYrWVhNVTlxTGxvClllbFMwc3dFZW56a0d6eUhVZ2Na\nMUVJc29CNHVMcHRLaXBlRnRLZ2pNb0UKLS0tIFRERnRBZGVFRk9sYmpzVjlpdmN1\ndjUyVmRZMFlFTm4zSnZWV09WbTNoMWMKM35a6GkCZIKscqgADrbIa48T8++wkhLP\nOFr03bv6D0Hj38VLWx+kh9kmja8BaxmdSUTeAhdORwbQumJBAqjsOw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHbEh0YkFlL3dPL1FmcE9m\nbjl0dHhQZlpBREMwYzQ0NEpQQ3RZVlNsM1Q4CmYwS0VDNjFaOXhOS3JkVUtaTEJZ\nSVNyZ1lXbEhCbE5XdGxCRWhsNVR1N0EKLS0tICt2Um9wQ0pyUVpnd1dVemM4NmpU\nTHE1bi9OcmsweDZyNVpVVUlITmt3c28KdX6fO1C7Ma66AAv/RCI5z8p/7fSvKWQ7\nCL86Nl4Xzb5WWxkteO4wOoHh4y0+9dpEAbS/XP78PkC07uRttcS7pQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCRmNheTZrUWplWFZJcm53\nbC94UHdYbXdsSFB0Nk92Q29RdGMxbUxVeEhjCkZqVk13bEFvNFFLZllTN0NUeFpj\nRkhlYXl5STJrbVQzeWg3YzlQZ1ZlZncKLS0tIGhjUytJa2FXa0VVTFlMN2ZpTjF0\ncG9ZTG0zL2dNekV0NkFZWWVrcFpPU3cK/Kia/sHk5T9nlbDg2G52uQcJUoPrnu3y\n6ARJKoz0MnV4csjS6IZCFSb7Vy5DSH+at3khEw3x00eGae1Jd89vwQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-03-27T20:37:28Z",
-		"mac": "ENC[AES256_GCM,data:35iUoodcjvIn+VAE20f2sHFaTh3+aqCYQ4HalWdVz4eUSkVNcdXs2uqOZtFv3MszDiH9izM84OyHwykudJ99QE3B/NwpfIoKQaU6Qg5X/g/rC1meffMaZwcASVbepjznahbTKmJqeSrMeybrBIV+6FaSjWXn0+D72GEEM1vgH9c=,iv:N2CbttHJsczm37qdapOCrlNeSSgsZBDlvWyvUpa3mkk=,tag:btniVwaVS9h4jDo4IM2wcA==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.4"
-	}
-}

secrets/services/authelia.yaml

@@ -1,39 +0,0 @@
-authelia:
-    jwt: ENC[AES256_GCM,data:L20XZt1eYz1srY+xIliasq4x2guxNIUOM4mVTPe/1uS2wQY6h1uY9n7yoMQ=,iv:OhTuutHQOVLG/CjX3m839Acw9eq/Yh3Iy947km1jalQ=,tag:nq/lwsfGSzeH6RsXLzr24g==,type:str]
-    storage: ENC[AES256_GCM,data:RW15TzoZifv0xrVAfrM7yFXv1ISp7v1c20PL4nGkQrXwjablPKQa5IZ0Fvg=,iv:YQ7+2h4O0Qx9BqnFU7WMaZuPtKU4BUo56/KPq2NQYxI=,tag:LQ8gWhf9rblGkN5bhPHPIQ==,type:str]
-    session: ENC[AES256_GCM,data:fJY4uSKRIcHDyDqndT9YiolOX1HDw2BphoaZONAv8AhdPV+aG5qj9Ppy3Rw=,iv:dcFZyIdZQQlyAORudsUCCD2wx4Sc7NF0dh/v/M6iYko=,tag:vBYU58mL7DecMqhX/TUdVg==,type:str]
-    hmac: ENC[AES256_GCM,data:K/qiyibBlu9wNh9IINHgYQiEZMromSA9Kf0iRVHPVuuhhUBZRyyfFyd4sLYNDLWvYKRJGnTBniIscQuBR+HU3/ttFGN0EkDsuAXlW3tKyLSxTiVgEvsKhA==,iv:2femAZUtSE9DjopiRIRT3Be3T2Qi0J+b8TaNJZ9vcjw=,tag:Sb7TT+1uxtStv20oM8oa8A==,type:str]
-    oidc_private: ENC[AES256_GCM,data:dzrykbgRk77yDbrnayTzSyiAjvgr5RUuDG046azumPinHL9wBaKpNdx6CqY7o+W95yOyVr/Xriw/aBbSyCZE8RoMchZhnS5Z8moHrIK7RryRM/BmEpOfyFLf9kpaO5QqSGyPt13yJQSA/3TwoXD4et3rVEdEz8mwb+vIA+G3WIZrNY+95KNjhwu9W648eouGBqJFfwTw0tm8mHsu+VZE8OYdp+ujSlKWZcVDEzgMEe+egXbvSB/3sk82HjolcqCmDx+U1TWMZfZdZPaT4RxONy+4kgGDW4FOqtsgctS2uRUQ2CLuRLD8xIulBO/VbsnNuticiM86BYygobq3RUdCKAFLUpcXqNWgnDBvnYPcF6mXPTmFCD3Gr2t4uRkqIIPc3NrW6DKnSO4pu4oVlUiSd9XaHGvAuo0yR7zcG7Zl4BAzhZa1HuVq6QmSNMf1TAo5P5zBc/NKlUVUhgIEKmRkwf95ZDyph1CJJagTsRZp/D4n6gbuzmV2Pjd8GxT6X+GOK7MQ3hPWsQP8+hhf8DArnVa988Z5cVxG3CQS6wEdEfc8yoHXlXwsB6iHjG4GooJk17GkP0YnMqOkv5Y9QbWXGNN/Zce6LJrSdvpd1Z8oWHxFB9ChFEA34tTYE/1wv0C71K6VRADnshBTyg0i+7GxvW0iyplWGEB2/DRv9WbpmIze1vff0KPlwvmdPXvZM7kfJE6uRP+DH5kJeIlKezA+hwuZmTLEu8kTdIkIJVfbzuOmXtX1yO+sQmSs6anqbSBuw5dpKYFFtQ04V+P27uTdi6lbUUfaBiHMhiW2A8aj/1Xf+pOV5oIN1c7PXNhAGrsNbmumQ7mBmbfOZeLC2aze5iKLSu5xqCzMNEWdlxXkmK+eEuUgDAQgW0pRAA12wvAFT8cf5BIeEPQQF4gPJprrQ3u93AXCVXve/TPC6rSEb+uCVq30JRGvIciFAEPWjhtSSO2Mh2zxjaALXVRE456k8DQq5mvovCp003EW23Io+lKDfg73n4LLZvbpHBVa3SQY0YMazjynJTo6UcDT3J/u9kNutIRjszzohMdW4jmykawPb/FFGv4yaX199bkTT/6/ztygaUTUTtWrl40p61lMzFHsz1qPy/5Bp4fxOYk6mLHpUFBpXUlu90ZxiReu6fX9HR6oQ1OC6MmpYjvcvxOAfIszgoMmp0LABJ1XN7DMOxpRrjNqW071xnel2/NzYy/gx0r2SdusxFJckGjrnyVzjEBVFwdpc9lZ+NdyzbNaElt/duk5AhdQ/iTCDlQpFsBhcl83Sbt38P/QlsOCPvRYuOz3vvOgeRprZn4hXuvGpQKJZEy+/rHDFijVABgbqLBxhfQiCpFmfwqQrcI+vFnPBGHP96p8S7xg5Dh2007QyFk9D2zHDHY6E+Iv27UkjaCZI29IAEdBe86IMtLI7Pl0q6XE44cHwD+QqzS55YlPj/F3va9LesoylPzBJwlxogciolfBQfQjLp4OF1rBSpy1Xy/Es7+M9eEsdatX1a3qFzYCJbC8+no5ol0PaIHx4ejH9aeoIiVfq/yXtzV04pJQz0bZfpfKVwtroyHhclEsP9pZVHnnexIFY1xqVF76V0kbusiizhru5ldOWE7smwXD5+KyMCTfDuxPnEjFBZLb/BLjo46sugJTAGQJhBBWJY+h7Je5PP+FnjQG28h4n4NMshhPfnyDEAZWNpDAHi08KhHOGzbNhPl+E+pNrNoNwmJjWbiqZ+P9LVQf1s5C+UrL+uV6qpeVKcm9tjy75fgVTD4iRXb4ejQIWlwO2EVLBzI9BXYsVmly6z0C+8f3wDPswwwocna9SonBus1QGudZ8cLSihZqSYmq6fCIFqfXTlCj3H0aOBNbX7dCYrles/y6jtn0VebQa3UEflXs+4WytpXdKEelN5f1PoJVnjrRF6Wtyq23GNbo1M9BTBQfpUf5x7QnZrxyIVbgvHq3JSR6/5p6yv6SGOdypCEqMtvnw9+bJMi6bxy55tXQNNpBB/GHWPqzOE9//9pqazJzikL/x7HWg/t+tJ7yV7MCFV6Bk2cy77j7i0fftxfHqjF7MRbnIaJRqxiTqp0z2rA4L797Que6a903b/u/AStMnsm8sE9gRy7P5L/PafqpgA/kK2FIxbDDP91cnvikRi2u+oaydHLhCkaq20SIupBCbgyDVkOXZ9n5EnKJDjFOAbOQ2UiXYrQPXDEMPLLUklBeLzQBHY4ZTQ7zzMb1tqvo4UqaHVnw2FwY+PoX2IPmF1ciccFO5uHX2w2qz8Hx0ZCPa9AsR/3HhKAg9sdg0cF0k3nXqTWCSs8j+9vpJxjCmrN1bXwoRA8K/ICYDoOtjb76c1B/Ahvc2YA7OULcM0EAzsQ2Z++cU/OCIcQatxzEx+TOp5i1yN2YnCFHqDBpE1UB2UbxBCYb+oEEBqB9qeFkQI6eZmvHASjdasXUtvnBYNCc3nliGfODoOXKLmzHQZJVPguWFu7b06zWA7fy3qGMjf7h/RhKbfkL9o7HkAvHTSh0+Lpc8gjPVu+sqLNUMyk3196LJWUI3nf7L3kUxkdSBdsJ/18FZ97OzC3Ws9dhhWe02ry3Y2ptRnIlLf8f4Y/P6FpqwR8Asa6NYBq+LKNSuWfzo4ZynkPt4irAm0LDOnZzbrRbQTB7tUHIA1dZMMWueIe22mUDOzTGDPuFSfF31rYbh2rmc3Tjvkumz6g53kdCV4QnL04htkMwql4KvpMCrkkMxDRlOTf1Xh10QrO49aPd29i7LbFjorGj1872hXszPDpmdDN78VApvMzVue8dKdhlz/x/9aCJnp9oEEgdObEg2OYyc29bqd9kbCOs5F4vaI4YdMrN9QKTqjAVG0kQAKH41Q7VCe0/jPWmGpH4Kd40RQ6/NY5g312D3RKV3V30DlCOIm+w1z7XzV2EWTgb5vgg4EbYyVmh3Y7wBguv2qOqzwhGMFrWGx+fTFAe5Zq8TVwvQUfeN/vFlYz+jc8ysKBbyrrAl4vKm2pz9Geu3Rh4AfRRmxawNjE/qlrTk6sWdWNJu7i2Wgk1C2+1FZeAprPg6EsZj7rFEGOFvZIjWrTi7n+IHI+8rRKDo3J5SkAsxiDaDo8dfvGecPp9ig5l9+OiN68t29HxfGnhJsk5eim/vkuA5mdFJW0cy7h3gtP1Z0PtRYsRoBO+hPp7dcYhhh9NqkP4LbVI8graz5FEf0yMmaA6ci7xgBWe/zOa0V539Y9cWzTK5zE2wrWI+mHKsbgUH9s+7y0tTVk9mPaNKhih1MHgCQiFyctQLzVnd6fXnv7JHzkkIY7AQiCjEZ4QPUrj99rDh0bikDtKX0hAiVedGMJQ664Hhyd3sWVGfrC/Qmob+4LhpE24kAxIRf94d2cB1zRFQ02HMGkbVUbge8SPNqqq/HoWkYvNo/ltdL0Nr5Qb1OmY0LP5txGh8cCQt8SD3K/ww+ZjD0ZbqqTwIaND9reyzXL0ryf8yNkiPCTpFiNmdL1rtHw+E2s9HtdngCz9XuGW5GRa4cL5xY1Yt4WBLEnxXwmyB/EOjBIeO4aJuwAcssL3UrvS/IEERWN4XrqVM4O81ainLaXeze1jj9VJcMb+/qz8dMdgm4WGkKfbbJeIsFCrlHOJ0CFNZZmijMvkoTvZ9WTq2OpxxZdsci1UmItlU60LETfWTUK8Q3YOo+c+fukIMPv68NLQH1LsiYjFXo9yDdzfD990uI5wdwnR3S3Sx6Vp04SkzJX7BAZ2UuL0wJ564Ny4S9Ew5BfWucd70mfQaEzOl52M9mqCyJYDfMYhd65YxkAEAV1dMg3FBlpZmOr2wtEQqXz+25cSPCNwQ/obCQt12cLNGRhyNi1Stz2E67Q9sesmssF7dgq0u/TeLezzVxTk13sJj6PzMtdpOYDwsgZJdh9hz8PZ32nJMTJnlkq6zcTYsbq23+HreCx1dHJJEDjpqZlttMYqLZ8mLLob25PzFaue164MbqozFtNTOc8eeOD+hoPCP/hfPoKoNi7oARs0fvwOwCQEug0XpMcz9mF/85ZBxYuDUBEP1vpbD9MpP/ECslqGdHuJePEFiiJOrDVggpaGcgWUfS2jwWv/46Bbz+W9QH+6Y8IevMf+lXPOL294g5VOoOW5k77naeNNCbycbijFD76gR5DtA+Vn+B6pxzF7l4E4VqC0Vlc1OUvYA7GLZ4rzb4bH4cEZiIb2/skDhJOmcb2btPWKRgutbmpHmi59eVbVkKUAKXm/WBw8xLwt2sLBS5r5R7aAZpMu/NaXFTfBEBGUzrH1u8Pfz3FwRK7v0QEyzhu2bS2JkGxSsaxD5+geQlvzN8eRYW4+pst/CfcCxTES9spBnqSWIX++rs8f9/mECf4jXzZQDv0fdbGILAU=,iv:GTKiBIir9+G3Lh45x77KARxi7paEsGP1m0qVldRnuOw=,tag:eCsjDzyO1g2HvnDhR/Gb4w==,type:str]
-sops:
-    age:
-        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJOG1menBCTTF3YURCOThM
-            Q3Z4bnZJYmtQY1RmdTBSeFlhZCtUVzg4Qm5ZClo5NFJqaWg3NElKQjRLcFZGdmxP
-            cFMwOGxoelJlVnJNamUxWFhETWpiY3cKLS0tIFNDWGRkYVZQWTd2YXg2aGswbmJz
-            MVJQdDV3ZGdzd3NYL29tYU51NndiNmcKtagAZdoZQo0y0atvRI6f1tY/3j8aD4RP
-            yvs9RVDdNqm990O5EudjMNhoKLXnFQtX9NlzYVHzrsX0UT/HSUi7mQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0K2tGaktsdXVPN3g0bXps
-            ZkVWamZGc0QzNk1TaVdla1RDaW90TVpYb25rCmRPL29ZNFFCbVkrbVpseW5SZlFN
-            dmlLWHVBb1RMb1dvY3NKNHc3NEpMZFEKLS0tIFluRGN6U2paVzVBdCt4d3FyMVZ4
-            Nkx5aHo4Qk8vU01wazdWdmhvNWRLQTAK7kiQiEdF1LpzQ/syjRjyhchShrnfhHFE
-            M/XWLSIcnnApt1dOyJhJlpsQTnT6Y6Fqem0y779/uOQCBJGavscOWw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzK2U3YlRLK3BuK1Q0TkYy
-            SE1lTkVXUUV4NFVuT2V2VjdqUFpBbVFLSTJnCjI3c0xpMnBnV0M0Q0ZHYTdUSVZl
-            MWNMQXowWitFVTlIMFBadVJ6OHBBR28KLS0tIHJ1M0NkZzFMSndIUjBwN2tFUmF5
-            b2pGTmJva2VnOFZlRWxlOW5wMitDUkkKrZyzpch6jTSsumseBEaN8xQXfng4P7ds
-            JSoock3sEmL4NSfxXSu+PP8kEOXFtu1yAcmSSeVDDhV7jiwE4egu2Q==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-02T14:06:11Z"
-    mac: ENC[AES256_GCM,data:wK8Nb1Vb80UfolzqZOpifZdoEKYu847anowYiCdSluoK+dfHhDhCj7ZxznYV7SwVACIoLsqLR5syRzC861PRBrAujkhbcn7lTc1kQRCjw0gMAbPYR/xiO76EHmiYqnV2UMN0EmuQg1nIRIWY9EO9C7m1b9fjoZFgDsj/7O99aVU=,iv:CJxUKpyNgEYwqLhSvuXoHb+Hu3M7ydKh0WlsjlOtKkM=,tag:4KXmNwwFrqvBjxe656Jvug==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.1

secrets/services/caddy.yaml

@@ -1,5 +1,5 @@
 caddy:
-    env: ENC[AES256_GCM,data:fyP1pPJgO9jN0ypC09s0Sz+HlUX42fl6DxWevYYevKdlKTgz5VHQfbELhy6vejmg9v+zFB3/AtSZfWJQB2dNX4Zm/L42wf5QZ7oYoa9QTujJjRgE96OXM77ioNy2DzFzpGw3w16QoC7zaR8UHSN1KL6qRj5xxKw0U6Apxhc0AuBoLvNHOgn8CHY92Q4OBcA1tJn8tgLB9uZB5Ge/2BlEjdSQ0sZMLkE+dHC4/0IILVFrrv1sWRXvXt6t5njF,iv:tF5GRPFYZSuKRgDAY1e8/J7jNQAEqDpgXlpwWW+1P4E=,tag:lK/BUErXNIPgqXPzGJvPTQ==,type:str]
+    env: ENC[AES256_GCM,data:uVCkVky5MRRhN+g4f634nBjvpcI5Ldy+eOKXg7eGu9foswTHA1SXDs67+Wuvo/jaPw7Zg67xKZRHnoTon1udQzyfu0T6pmVKfsUPewITYCd+qLTanFz6uVRUHzpUVwjCZNqB8gxNr/BiZ70NG4vQXRjgd3zKFrQYQBr4zSaP2vK1pRdbuQ==,iv:dQBfX4X8huUp2dqY3tEGW+BPZ/XADT10ptt85R7X+AY=,tag:cvMbFjkRHoxxnNfz8dGv5g==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -33,8 +33,8 @@ sops:
             Q2hBZE1FOHJ3aW5rVmoyK045eG11cmsKFOmP5iWONREZvxu0rM+fKMPQKgnYq5LH
             AKMZFsP7nnUxjdCXEA18sDg4Rf0qp8i3uQK3D6P7417j9ye/YZA4BQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-08T21:05:07Z"
+    lastmodified: "2024-12-17T03:25:37Z"
-    mac: ENC[AES256_GCM,data:vgGCrCJMBxjiCWZYymlaPKTekA1Weprwgtc4xcoPVlDsuljkXDth+aAZPpnakE/nSXhGC6jGJOHdtrsIUTkH2R9WQHIdZDBy+VrVQoV6xE3ijfWyIujcIPwz3s1MGBqRFUYum1XMU5FAcIASiYV7PDxj/f6fsLbjKZCc9/kG3GE=,iv:PSvlssl+Gx+Gcw6/zccIKJDeNz3dJ0kHnPmCrAdBnqQ=,tag:6F/JKBFNxKEgMTyYZ3W0Vg==,type:str]
+    mac: ENC[AES256_GCM,data:bhFBLkT2q6HGtTPtHLVZkKZn00Lbm11/u3qSR19lU2E1SsQ7mpukvCqcTxNWtJ+HHth6yJJfgM6XABKq/9/598L2MgGuF3C/GGS3xpjwHh5RyV8t1lV8cqDaZGjGOMGx35lFQ6DoXOreQrtP/f7MKzf+nVNFr1NbTR8YhqR1xDU=,iv:+fjYlbyIyM9nLagrvE+PUhC2pT7QTsTSQX7ELZ7Wuhs=,tag:GWQv6VmIsWwFzb4bUr5CLg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.2

secrets/services/garage.yaml

@@ -1,31 +0,0 @@
-garage:
-    env: ENC[AES256_GCM,data:miNp4SJ9xuMXSEIJYCZFWM96enAh8uwCxv0ySn2Jbp5V4Iso2uZ2R9dXqSS7y60pRq+bbXPYbBxBnmb+fhjvB7TdCLPom9CKSY8zMI7n/p1IE4qUFvzCG4ejV6BIsh/887BjzAx1UNcRG/9eUNcMfTu58wQwKmIzr1iu5pD+IlLHa+0/orpZKssQ2Ba1hMwLOAXp,iv:zgkGikunB4zQ4CfGgEd1DmLgYpEREJhoX4oT/zK3mI8=,tag:ohpZWF/lPHQc010mteJZDw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIemdMVVE4alZ2MElWeUpj
-            TjNhL2VYL2dwMmN0VzJxVGwzWHgvbm82QWtjCk1pem5SdzFpR0dRci80emo1VlVu
-            VWtWMVpoN2M4NUphcTgxeTB6aU83bjAKLS0tIGlJanA1TFBnaE9PTmRnQWVidE53
-            elRZaFVaZ1VTRU1MbWlqSkJNZG1oRW8K8IupEpJzC0CJGpxSTssiFrQgdHAzCW4I
-            IlvYdZkUou/6km5OMnsFqhqEqIjAwVuJ08YiNzAv67ZzTG0ThD133A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiemRZRmF1NWozM1RFS2Z2
-            bld5V0lTS3V1OW1SU0VaR2IzZjJmbEtJVkhjCnBVKzFYUXYveGdkSTVmbzRldGRo
-            eVAxWXQ1TzczVjZiQ2NsUEk3YmhGNk0KLS0tIG04d0FDYXF1MU5ab3ZMTmpCUWNa
-            WTQ3dWs4enQrc2F3K3AvMUQvWEh6RDgKxJl3ftSpIrK+45LzjX9gIy41Lv+bcZsV
-            7rriUhKAtaCXsQcO6Povif7zJyCROYhC0sgpRhmMKoN76TAH3zxvag==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-08T20:44:32Z"
-    mac: ENC[AES256_GCM,data:rVv9sNYb9Fttm5IjonAZBmcrCqC1cAp2sjMJDZ3JMt+YeyiCUI6jsXSGAc3pgP+7vvaTvDvdNwlAa5axxA72omE4eAK+9me0RLI75vA4UGrh3KiB4qrHK6H6qMUFg92uhKFo+uhtxERIV5/HSwbZPBT2R0pbSSQzTKk5U9UuJsY=,iv:CRSEqphlBsHwPvwXlTQui5U4fsXWgWnZ+8KYFAyVRlg=,tag:82mxRsp5uCo235jzJNK8LQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.2

secrets/services/hedgedoc.yaml

@@ -1,6 +1,10 @@
 hedgedoc:
-    env: ENC[AES256_GCM,data:9xnOlQrk1qCyiAHSjmu8dvj2/z/BrJlngNGAQnMwvLsL0pnyvvyJLnYWTDYix1a9o8OJUNLw6Qhq7KbY4uXfxsNZkfGdVHwvkvhySjR2rcX/r90txqHJUUIxE/TzdsBvonzQ0F85KfXhsi69gKHp016gCj+jNf6CCY+tOVpt71el4Z+jzqLHasuQET8GctKJRzHOfNfCx/X2kJeb7RQl3JFC6/VmYT45bUk7uFfveFD9ao03wJwLKi27wO1WDrfpOigFdvkmqpbWZjaILYHYmkdhdlhr7w330CiCmGHT/ssmSPcu5cYUc8tjYPgpYLjusiUzpE5jmut5GaNwZsY9hNuow/mUVnQ/tCDH0ChOq0DQisJ07VMYlRII9tMdcuT4IbjjwiRcYlORAHsTFUuo5DCaDp8a4mx846BGp1YMQsvqJQgOe4x15VMpeB/ptxm79qxcLZKZ3BkiJaKmDdWsVk9RfqVgsxqiq16Me2EQhknO2s/oBjGOaoIiT4NEuRFQl0BIPgIMD0lYzKx0uDaYyclID5W0DqMI+SrcBd+WH/BB9HPdZx92rFe34PzjZse0i6+5UZHXUu8au6CyLMqGkUlzkSFwVT5W7Lv2m9P3+6YjgPRMaYbg8b6kmavB6EtjiqWtTbMKr3nxPVYJc5FRImvebfFqiLy5MWoNV6Qe7TUGIk6QtX2OWBhQ1UB+IpR+180QH7yw7UpgJ9EM8dD2m2/smar5P0BjAaqAFib++GzoB0OfFtxJNUjrejQC11tRWBXYvcHWwa78VbKPul0xqiEMmsAZufMix4lD1EgutTf1CXfv7l0rUpLwkYbWIq2hT5UI53L0YWJDl7zlhi94ANdXV8z8kCvMeXm2Fwl/vIgJ9JuFeVeVYPpXwx2coLBwE6uI4SuFvY1d4ojvzY8KftcHWO7srVzpuwrwW+6gKLwPQyEazv+sRKXAGo0ffMO2/2KRgOu9zGwaOFaNDAZ6gYFDWbPz6TMfNWHzfLEFK5BlVAL8KDb78IODUBYcMr2CX1Y=,iv:LDkuJgxIbohEVf7wmdtOZ/vlPddMYa7uzHGkL+0MnUM=,tag:pnJiCJydjTmUbS761fPUPw==,type:str]
+    env: ENC[AES256_GCM,data:15rWiIYWyIJ0Hxl5I8m+EBV+FkNDT/OHlLK9shVS46UE7SQtuIh45N5hvwgs0rg9E9Tawu+lyE2aozWNh6HSDUZ1h4FYrB+JHwIetGkOqXSLHfXi,iv:v9ohLTtlxw3fsRoJJoOY5VYxVsxUyDEsQHRjcGKg/GY=,tag:Wncm1reqNblnVhRTYjU3Pg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
           enc: |
@@ -20,7 +24,8 @@ sops:
             enlDZEI2NElkZkI3UmRyQUZqQWE5ZmcK2JlwNzVJNhGjyniIg9UY5tjgUKttkT3e
             9C/xag3dQCiqzX1O3o5tdhYnxXw+VxVf+qTFyyuftg5iQPZNuvX6mA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-05T21:08:15Z"
+    lastmodified: "2024-12-17T03:25:54Z"
-    mac: ENC[AES256_GCM,data:cPisYUoZWd/vd+wWzz3xTnftj1RdjK20dWFo+MKssm/eu7eCOWDIaZdcJg13gkTleBpMWQy/mG1drC6GLfGQiBmkS99UCPAoo0aLTBL4FbSm6FEXdbVjoOI7URu6Sj31drWCMAm+lXYymWsHwZJrNLhjsCTQsxTPvFq8oOdNlXo=,iv:KpmJoZ/BGEEhZ75jXfXxegNglm7k6mtleRuVud6tX2g=,tag:lsiqX+YSz4mGK6mw9gdKNg==,type:str]
+    mac: ENC[AES256_GCM,data:1cxiK/HhqYzatT2PhZxjvtizII2QMHqbbyOujUtx4cT8x488j2wecu6hOfSkuHbQ43AxA8kDH1NAruPCSdCpj3PytMR+np+R/5WuRcK+OF/FCnWvWvvHqgDnBs/wYjllnR6HyWBlhrROpINxu9ch4fzN0Def3I7O+wJgpojnPiU=,iv:PKPykPv9zSHj9+HXnrg1v8Ty78te66D9ZH6c1V7Qlh4=,tag:JQk68u6p317r3Df+hv16+g==,type:str]
+    pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.10.1
+    version: 3.9.2

secrets/services/karakeep.yaml

@@ -1,35 +0,0 @@
-karakeep:
-    env: ENC[AES256_GCM,data:SWc26EQaKR5d9hMDYzVHA/r7XfjwFZ0d44Co0IS6OayR24ej7yqLAtkNttROKoKFuYc0sHgN9bOy4MyX0s3qiSWYovIIUJgFiJjPQFYDAo+50WR4+5W5FgvYI6e42fcWrQhaCXWQrDyzch/zT2OITZsjXcQhT5E+IiPLVkaGOjGptE07GjM7ZXI4UxBzINFQOhxdfIO0km1o6Wq8GhJdWsz4exz4ahRslR+WjK/flV2GZVAj6EHSJ5sHohm74QlhxaShEbc/8IKP6R2gSjBFP7l8VvwFyIUD9sLzYGvS3iU=,iv:gSPQU0bZ+VRFbuaNDc90dW0ogWX2SMH7kewtq/u/11E=,tag:L0Y4EWSQUhcn2eHt+yZ7qQ==,type:str]
-sops:
-    age:
-        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaWQ1Q1JwRHJxQjNjdTAx
-            TXRsWjVZOG1mNEptNVhscHBaK2I5MHhjdlFjCkNqOEhwT3hyOHpHQ2k0ZmowUXB4
-            eks2dlpUS0V6VjBEYW9UWnhFOEw4VGsKLS0tIFo2a0FTRE5WdHBGVW5DOUFkaE9p
-            bitvUnJXSnB6UnV3VTEzSjlSYmEwVUEKHOwFCRu+SIyM0uJ6bNEAo+MMlsc8la6G
-            bLYdCoykcBu+uVXqn3BYTbrS5ylQMRYcbcPFJw5BVdmjIYF4LU5W6A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrU2ZnNVAyeVdJeHlTSW1x
-            QUhKRzlNclVUWE1ucHFLZW5sL1lnUDhkd0Y4CjFuekNEOE1icDNqL1JyT0hEYW16
-            Q2VyajJFWWtGUnBzOENGOEZHbWROZzAKLS0tIE8wMVc3TkV5Y1VyenIvOW02NDNq
-            cStTeUcvY1pJWEN2MzFEeThKT0JPc1EKXrtVG49a6YZVKiL1F8Xg3t3niTYv3LwN
-            NeAQ8srV0F6ckky7OCkvUp9GInZCWRzULXV/x+4IUb6C+KQaNm2vYA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdDdUSUlmMk5VcytyT01N
-            UmRaK2k5Wkh5SlhPT3QrczY2eW9vZk5KWFZBCnBteitnNFlHdWRaaTRxSWYvYmtG
-            ZnY5ZXlYa3Z5aENlRy9BQjVSU1F3UzQKLS0tIFpjN1dOaWNKaU9PaENyaXc1K3BU
-            K2orZ0Y2Z05LSUZ5WHQ4TnVVY0QwSzQKiUQT4aSxXnaq0kEMp+q5WnIUoGypEmZ+
-            DQEhkB9yu/BrkjXH+HGQr1W5B4sJyb5rnl0+SQ+IypRIRyaX4CdFxg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-05T19:44:58Z"
-    mac: ENC[AES256_GCM,data:OmqsJI9BaICOTiH1cq4gZlNBbkAxn/pAOWBtkIjHdqpikABLG6fMY+sLpyeaovXjexIj9MZk7fPmV8dRZ5VNLHCqlYXK/cVoQBZ2HK+p/cGTAFelNAShu9NSgZdFmVgJJtOjVvFp8dtuY8VcQj861k/MPX0mNZt9pmXYdumjpNM=,iv:efHkp1KUctwtCjG9A8i5qs7nQfQqv2ya1yYlHHOt8pU=,tag:4lChpspl0oOUMiXzvGuA2Q==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.1

secrets/services/searx.yaml

@@ -1,31 +0,0 @@
-searx:
-    env: ENC[AES256_GCM,data:VWLft5+85mNA8k3VynVBz2V+8zcg97UtHfucpaAcKbA+CQdGUbqLesQSu9a7tNRI7+OdI1qPJj5HTzP8tpGN5f39D4brtyo4fN8n8zAd,iv:F70wq9qJiFjEjJeZeFCyQskLdBR3nd/CR/UW/dE9gTo=,tag:/W8FhRC180aAdzjD5v0vZw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEM3VXOVZBSVdZMzBOVzJD
-            Y0ZvWUtFUW5pMUZnYjdxdHQvWDBEVmU1L2hBCi8zcEszZThwcGQ5WUdRTWFUWCtP
-            WWE0OVJIOXpCMGJZc3J6TmVCMGN2TUUKLS0tIEwxVDJLTkdrK3g2TG9iWml6aEFR
-            d3NOS245SmV3K1dlaHdnMHpVSzlYQk0KnDSK1C1sEeBVMX80DqjJRrGFx+WkNijg
-            XEf/Jq//qzgvX24fOl4X4xGTRfBMbLlznLs4N6WtIY7aVcW5N041jQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCOGFaWkY1TWhvQUhENHUx
-            cUk4b2FpeCs5eUMyQ2FhZzVKdHY1MVIzWUhRCmw0eEhwYjl2OFNoQkZRVW43REQy
-            OGpNWFRTWEF4NFFuU1lpTFdKY3lBNEEKLS0tIFNET0JBZmxoSGhWdTIwL0x2Ris3
-            ZHhidlJHT08rR3ZuME9UQmovRTFGNlkK83k2wqXQvxeURrUE/hXoZMDc9lqkgBuL
-            W/UWt/PBorp1/WRqO6dpuu9N2S9i6VCPJH0jdoHMWEqWuRIENFKVhQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-08T20:52:15Z"
-    mac: ENC[AES256_GCM,data:UGFkCgmgRofmX2gQR2W2DD0u4LowQ9pmUxPOgpLVaKGasEoNWJMGu7A7rUIpHvuUomoL6q8aiWs3kiIuZrTQ3CB5gawmU9pPiEseOAdbww4beIcnUmumwmCLH46XYQdaooPaz8bIncW/gFePRpVB2Oef1pYeryXkbZRwBm+bPOI=,iv:GGFjerxpLH8C1m50AiKoEJxj+lGRYNMe4Y7k4u232v8=,tag:woww///+80wakvzYoyWCqQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4

secrets/services/tailscale.yaml

@@ -1,31 +0,0 @@
-tailscale:
-    auth: ENC[AES256_GCM,data:7gGiUBRUK25Tp5y/5DDZKOTxKPFFfN1UUeBOdMLLQqobq643MKdJ9imxkKmKFg/FwgLYft/uzdxQGGlE7Q==,iv:HRmd+T1QuTYP8VrX/bZt8dWSwm5rcUvpEMqCMPfxjE4=,tag:PRZn2Pm6yydfEULrYGM6yg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2Z1JZZmZMaDQ3UHYvbXYr
-            c05RaEMxUGJXSGczUDBkL1UxT0hjQ0VNNkJNClFUNmJ5d3gyaHFwMTdNVW9GQ2ly
-            V3haMkx5Z1B5dmJ0SE4wY0UzMWswQ0EKLS0tIGNpZVo3UmtHcjFZVE5FMmdpOGMx
-            UFZGb3I1L3FJYVE2VjJ5aTVoZlo4bFUKwH2sPBwuLQXrHmiKYSu4Eut/H2j/2tUW
-            1y8Eph7l6w3kfhZRRbo6cZ8gcbZNHPSPeAvWf/TpYumiTt1WBt8SMw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSVXBMTEMrY1NGa1NBSjZP
-            R04wYUsrdGlVa3FnL1NYVG4xdUdqeHNnM0ZJCmhMSzFoRVFSOFBrQlU3VUtwaU0r
-            TEtad1B5NGh3OW1oajNvckhJcExrU0kKLS0tIFc5K3JOVTUvSFU1dmQxMUFRZ1o3
-            em5IemlsM29zVy9GK3RmTlgzVnRpMDAKRatmFgCdoXcypQ+1EDedCuVctl0SFMf4
-            kjtHrTSpept/y9bpTUy656aPRQ1LvqvfPs7Co1ssC/YWFroDsLgv4w==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-24T05:26:20Z"
-    mac: ENC[AES256_GCM,data:GbQrLESUR/x+eLzukOR1FaJsd8zxlrz9dc/2kDBKUYAgI8L4QwLmwRuzpaIJgNLv2PdLTW83oSC8ekxR8fmsap40DpiygcrmPdPUeVFbEPaz7SSvU+DCgB0UX+qNQ9aOQ0BIbeKKOIj3r9enGv2o6DKY8I85n7VXjnGZAmCf1C8=,iv:UrtVqRGwvOpXOH3X3qF6ZF+VwqO0VGt+hFG7r6oUqCg=,tag:TD4mG3t5ORYgAS0GBmA7Eg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.3

secrets/services/zipline.yaml

@@ -1,31 +0,0 @@
-zipline:
-    env: ENC[AES256_GCM,data:5n056AoWvM4PXBCxm+tk2G9qOugRpA/n5YRrxTtB7XBBQmRQNaP2a6AbAnWX665yFGQsB0iHdSER3sY78RqUL0gFKupVq1UAT8A2Wi0HqcFMqUs2drXjIksdmI6hTLk9TCxtPy0VbPieIshO2VEYesUqitTZ01i8Hj5CyF8yFC6t9eQ2L9iKLm5gje80MoqQT4IFx+V5B4ExP3fzhcpfr8StGHKHvG59nc40KQAW38i/95H3nncScOBfSQSNH61wLnDjecr8srxELO/j2iOKD9JzmqYLQr8TLKNw7KIIhDMAmuNeQhG1YXtj7/nj6gHN6cHpcHPgUdWID/Y6MHcndDCIJnyC2Qeod5ShOn53IjL7C8VZ940o9LfwNz22sx1SYZEwRGktIhUY0c4IL/4bUvhxwTcMH9ITYU8eVfG/QSnr8B4=,iv:juf0dRagztirDN89Jj+v8k62BBl9TU12A8TdR/m8qDA=,tag:WakN+bOYfF4YrleIsAg+OQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDUDFDSnFEM1NZK0lSMnUx
-            YkI3MWlpY1VjYXdaKzBCOFc5NWp5NXdBbkdVCmI0Z2tuSXBOSFN2NXJTUWxKQXNu
-            SGhhTTYzUDFSOFFXdU5aVHlmYnJNa1UKLS0tIGlrUTErQkVRdFBYYWxUcklHaUVY
-            UkQ3eVlDR2lMOEZGNXRjU3J3RXpwZkUKNJL/dvPsGu0AJiXryR8uSM0jE//cQi0b
-            AeYUjXLRcouUq5zWL6AsKDOUAo9t//AAFZqv3DGUboR8UzdymYRYMw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Wk9ZYkExU3k0ZWpOZEhF
-            TkswRGxTd1hpcGJaa1pmcUJFQnZMcGV6L0ZFCnp3K05YdU56WUl1TktVSFNQWWZH
-            bG5COXVuSjFCUWpEYXQweVFPaDAzcTQKLS0tIFgralQ1TWUzajVOM3RyS3RDcnRx
-            WHZSeVJIaGRldmhmcWZvT3YzL3hPbFEKVUtCU1l/RhFOlwdjE0ejW/Ym+cMVNxIW
-            AdvVcWoilMGTsDJIIlLu7fPbhmGotPvqGjxMC2yEpEgJUt/rsz2vPA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-23T21:43:15Z"
-    mac: ENC[AES256_GCM,data:nI7xnLUMtseY9q8XZ3owb6qtRBtaRmmNNK4Z5ELHaI85VowdItZXMFN9faCVuCVTzhKp/4WC8jm96k7eWxytzW6r6KRvKDrUaRV27UweraK2Oe8et7u+oIEPh6HkNuZFB+qPiFYdfc+qQeTIKwayEVLeVWyvQKVDBhBxZd9UArg=,iv:q4hRQVat+LHVbYnF6QLE8iBdBeacJVUBKmMe4tbU8YU=,tag:6m4+SU1BFXMPORqe9vgXAw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4

secrets/yt/aws.yaml

@@ -1,36 +0,0 @@
-aws:
-    key_id: ENC[AES256_GCM,data:euyq+QtSXv1UR5eOJfvZARhm5L2AuzKIOk8=,iv:RseSyVArmrawNzlwjNh6FScJF2O+F4FBuIq47uMQQEA=,tag:bkZJeX3rUHb1yZu8dytgcg==,type:str]
-    key_secret: ENC[AES256_GCM,data:27BHAU5suCIiSKAf0+1yNa/VJ0umErb6Ry8HI+Zfv6LV+7eB+wk8H3kxdV4wmY2XayHsUrD4FZa30O0a9PdJgA==,iv:oI2X7PCXDZBkUOikHM8S7gHsnMtWp7jxBqdmfbUlrwU=,tag:9mZ3H2jobKqYmw6S4NNpjw==,type:str]
-    _r2_key_id: ENC[AES256_GCM,data:R0xwzUx+6l9SR3Fd93PfJw+WPV0ByzOKMxoJQtn4pEE=,iv:qHmr/HssM8U3znbGznSIOwkAhNaORkCkG9lqAmCKmfw=,tag:LhuiiKSq/VnNEulgrS71vg==,type:str]
-    _r2_key_secret: ENC[AES256_GCM,data:Dw5Gq1URjMpy9Bh1IBYf+/EnkvQA/4yAC4kdoACpCUuJQxdQphFKwWmxJX+Q/oztO1imWoGIxlZNNDr5QCqXaA==,iv:hGePo+Ffe48n1BXI1f2V12C9Gn1CC1nTwbSsfqUGQ3c=,tag:AIy/F3jPGz2WHge3Mk43Ag==,type:str]
-    _garage_key_id: ENC[AES256_GCM,data:2lLS1nBhrwBkJh/ei7FwBoR6jOI6KCJkvOs=,iv:jwB7ZEaKOPIwghcGRs3qaICypoHgSxkFBOyB6e5hpYI=,tag:Iqwv3j1R1uLLUDKLhN1Atg==,type:str]
-    _garage_key_secret: ENC[AES256_GCM,data:5iwwMfojHrR79cOIY+9O2oVY8v1cbPcECMSOMhWuGAdc2lfCogKBwLM4TFwBH9X1Vx56QvUoxCQ2uSyfOMLR7A==,iv:Q523ttz6ijmv8/JlVZuldFR4IabEKiVN4sGmJ9xDJU0=,tag:ZZ4LRG4DXOC7LY8hEjXYHQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKaUZKbTVjZ1NEWlE5RzZT
-            T1dKdkRQajEva0tpRXhxYUlYWmw1b3MwSFZvCmhteVJ2VGhVNnZTZkJlem1OT3dL
-            dGlQTWdOUlo3TXNOS0wvNlpqVWpZSFEKLS0tIC9DNjY3OW1zWUlRQ1ZEOGlBRk9R
-            azQxMGhQejQ5M0N1YjFtSW5uVnRCQ3MKtt26G2PxIry/lppOT/NUX8jebEb5NgqO
-            HuHj7WT51Gtotfgb22VfGeOCaw9+pPYSjdk9WV4z57r7Z/lylALKRw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPaVIwbExDUjJiVFpHOFJu
-            dk1SUHc5UDRFUENsbkg2RmQvazdEZ1NKeEhvCjVCNzdwRFN0aUZJL0pVSTI1RUxv
-            Ymhhc0tsSENVa1VUKzRBZk5IcjEvNFUKLS0tIFpPNlRXOVYyVnpyUmtLMTFqNlZ0
-            UlYrTExEUVc0dURLR1czN3BnYzZ2VGMKCbAgM50jvs9VciA1Pb/VY+2I4x62LBGe
-            j7eHkfTFc8Gnk/rZA9/ZJDLFr/FUPMQWK/NVoz6oLjO6oVFXqN6OqA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-16T16:45:13Z"
-    mac: ENC[AES256_GCM,data:DCx4uVuy53Gz9Ha2p/GjxTigKw/dJ0gvWIAII9AtKQCURu1OfiJ6Lp/ht6ndJwn25em11uppN371pQGxa8FRtLL+dX/YgoDmOw3Tgo3lc5VLBzalRqXHInOGHfgv9k1jHNq6zokKbBLDItBnUNOCvsLTXXenVRYdnkiuf3QPGhk=,iv:gBbbH/nJExK/dEXKHo+cCr+rxQ4uJQWweK0lYT7amsM=,tag:9GaCGFrcinqGfpibUNQ75w==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4